Trojaner-Board
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   GVU Virus, Dienste lassen sich nicht aktivieren, pc langsam, Abstürze etc..! (https://www.trojaner-board.de/137712-gvu-virus-dienste-lassen-aktivieren-pc-langsam-abstuerze-etc.html)

kevinanthony 04.07.2013 16:28
GVU Virus, Dienste lassen sich nicht aktivieren, pc langsam, Abstürze etc..!
 
nabend liebes Trojaner - board,

erstmal ein paar daten zu meinem pc falls notwendig :
intel core 2 quad q6600
windows 7 home premium 32bit
nvidia gt 640


wie man dem Titel entnehmen kann hab ich den gvu virus auf meinem rechner, wie es möglich ist das ich ihn benutzen kann ? sobald ich mich anmelde schaff ich es in den taskmanager zu gelangen und den prozess zu beenden.. is natürlich keine Dauerlösung.
habe schon versucht mich unter ein anderen benutzer anzumelden -> gleiches problem!
gestern auch versucht eine systemwiderherstellung durch zu führen ... FEHLGESCHLAGEN!
desweiteren is mein pc langsam geworden, Prozesse brauchen aufeinmal viel mehr speicher zb: internet explorer bis 1gb ... obwohl nur youtube offen ist.
Deinste lassen sich nicht aktivieren unteranderem Windows Defender.

ich hab mich etwas hier durchgelesen und habe einen Scan gemacht mit Adw Cleaner by explod und auch die Logfile parat.

ich bitte um HILFE! :)

# AdwCleaner v2.304 - Datei am 04/07/2013 um 17:15:36 erstellt
# Aktualisiert am 03/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzer : kevin - KEVIN-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\kevin\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gefunden : C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\searchplugins\Web Search.xml
Datei Gefunden : C:\Users\Kevo\AppData\Roaming\Mozilla\Firefox\Profiles\scnt2amw.default\searchplugins\Web Search.xml
Datei Gefunden : C:\Windows\system32\roboot.exe
Datei Infiziert : C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk ( arg. : hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&searchtype=sc&affid=111583&babsrc=lnkry)
Datei Infiziert : C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk ( arg. : hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&searchtype=sc&affid=111583&babsrc=lnkry)
Ordner Gefunden : C:\Program Files\Ask.com
Ordner Gefunden : C:\Program Files\Common Files\DVDVideoSoft\TB
Ordner Gefunden : C:\Program Files\DVDVideoSoftTB
Ordner Gefunden : C:\Program Files\DVDVideoSoftTB
Ordner Gefunden : C:\ProgramData\Speedbit
Ordner Gefunden : C:\Users\kevin\AppData\Local\APN
Ordner Gefunden : C:\Users\kevin\AppData\Local\AVG Secure Search
Ordner Gefunden : C:\Users\kevin\AppData\Local\ConduitEngine
Ordner Gefunden : C:\Users\kevin\AppData\Local\Temp\Smartbar
Ordner Gefunden : C:\Users\kevin\AppData\LocalLow\AskToolbar
Ordner Gefunden : C:\Users\kevin\AppData\LocalLow\AVG Secure Search
Ordner Gefunden : C:\Users\kevin\AppData\LocalLow\BabylonToolbar
Ordner Gefunden : C:\Users\kevin\AppData\LocalLow\Conduit
Ordner Gefunden : C:\Users\kevin\AppData\LocalLow\ConduitEngine
Ordner Gefunden : C:\Users\kevin\AppData\LocalLow\DVDVideoSoftTB
Ordner Gefunden : C:\Users\kevin\AppData\LocalLow\DVDVideoSoftTB
Ordner Gefunden : C:\Users\kevin\AppData\LocalLow\PriceGong
Ordner Gefunden : C:\Users\kevin\AppData\LocalLow\Smartbar
Ordner Gefunden : C:\Users\kevin\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gefunden : C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Conduit
Ordner Gefunden : C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\ConduitCommon
Ordner Gefunden : C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\extensions\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}
Ordner Gefunden : C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\extensions\toolbar@ask.com
Ordner Gefunden : C:\Users\Kevo\AppData\Local\AVG Secure Search
Ordner Gefunden : C:\Users\Kevo\AppData\LocalLow\AskToolbar
Ordner Gefunden : C:\Users\Kevo\AppData\LocalLow\ConduitEngine
Ordner Gefunden : C:\Users\Kevo\AppData\LocalLow\DVDVideoSoftTB
Ordner Gefunden : C:\Users\Kevo\AppData\LocalLow\DVDVideoSoftTB
Ordner Gefunden : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\APN
Schlüssel Gefunden : HKCU\Software\APN PIP
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\DVDVideoSoftTB
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\DVDVideoSoftTB
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gefunden : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gefunden : HKCU\Software\Ask.com
Schlüssel Gefunden : HKCU\Software\Headlight
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gefunden : HKCU\Software\OCS
Schlüssel Gefunden : HKCU\Software\PIP
Schlüssel Gefunden : HKCU\Software\SmartBar
Schlüssel Gefunden : HKCU\Software\SmartbarBackup
Schlüssel Gefunden : HKCU\Software\SmartbarLog
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKCU\Software\SpeedBit
Schlüssel Gefunden : HKCU\Software\YahooPartnerToolbar
Schlüssel Gefunden : HKLM\Software\APN
Schlüssel Gefunden : HKLM\Software\AskToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{B2E753AA-5E80-4380-B3F4-2E34FDCF9C4B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Conduit.Engine
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IESmartBar.BandObjectAttribute
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IESmartBar.BHO
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IESmartBar.DockingPanel
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IESmartBar.IESmartBar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IESmartBar.IESmartBarBandObject
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IESmartBar.SmartbarDisplayState
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IESmartBar.SmartbarMenuForm
Schlüssel Gefunden : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gefunden : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{0BF91075-F457-4A8B-99EF-140B52D2F22A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{37425600-CB21-49A0-8659-476FBAB0F8E8}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\S
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT1320680
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2269050
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2319825
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2431245
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2857573
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Schlüssel Gefunden : HKLM\Software\DVDVideoSoftTB
Schlüssel Gefunden : HKLM\Software\DVDVideoSoftTB
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B2E753AA-5E80-4380-B3F4-2E34FDCF9C4B}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\120DFADEB50841F408F04D2A278F9509
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2BDF3E992C0908741B7C11F4B4E0F775
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B3BC4CF5ECE1F54BBA174C13A1AB907
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B5BAE2ED018083A4C8DA86D6E3F4B024
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BEABAA33A5E68374DBF197F2A00CD011
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB61AF52AD64B6B45930BE969F316720
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
Schlüssel Gefunden : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Schlüssel Gefunden : HKLM\Software\PIP
Schlüssel Gefunden : HKLM\SOFTWARE\Software
Schlüssel Gefunden : HKLM\Software\SpeedBit
Schlüssel Gefunden : HKU\S-1-5-21-3072820278-2867077185-342124202-1001\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{30F9B915-B755-4826-820B-08FBA6BD249D}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Browser Infrastructure Helper]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16611

[HKCU\Software\Microsoft\Internet Explorer\Main - Search Page] = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}&installDate=01/01/1970
[HKCU\Software\Microsoft\Internet Explorer\Main - Search Bar] = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}&installDate=01/01/1970
[HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}&installDate=01/01/1970
[HKCU\Software\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}&installDate=01/01/1970
[HKCU\Software\Microsoft\Internet Explorer\SearchUrl - Default] = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}&installDate=01/01/1970
[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl - Default] = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}&installDate=01/01/1970

-\\ Mozilla Firefox v21.0 (de)

Datei : C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\prefs.js

Gefunden : user_pref("CT1320680..clientLogIsEnabled", false);
Gefunden : user_pref("CT1320680..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Gefunden : user_pref("CT1320680..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Gefunden : user_pref("CT1320680.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Gefunden : user_pref("CT1320680.AppTrackingLastCheckTime", "Sun Jul 31 2011 20:31:40 GMT+0200");
Gefunden : user_pref("CT1320680.CTID", "ct1320680");
Gefunden : user_pref("CT1320680.CurrentServerDate", "31-7-2011");
Gefunden : user_pref("CT1320680.DialogsAlignMode", "LTR");
Gefunden : user_pref("CT1320680.DialogsGetterLastCheckTime", "Sun Jul 31 2011 20:31:41 GMT+0200");
Gefunden : user_pref("CT1320680.DownloadReferralCookieData", "");
Gefunden : user_pref("CT1320680.FirstServerDate", "31-7-2011");
Gefunden : user_pref("CT1320680.FirstTime", true);
Gefunden : user_pref("CT1320680.FirstTimeFF3", true);
Gefunden : user_pref("CT1320680.FixPageNotFoundErrors", true);
Gefunden : user_pref("CT1320680.GroupingServerCheckInterval", 1440);
Gefunden : user_pref("CT1320680.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Gefunden : user_pref("CT1320680.HasUserGlobalKeys", true);
Gefunden : user_pref("CT1320680.Initialize", true);
Gefunden : user_pref("CT1320680.InitializeCommonPrefs", true);
Gefunden : user_pref("CT1320680.InstallationAndCookieDataSentCount", 1);
Gefunden : user_pref("CT1320680.InstallationId", "default-xtns205102");
Gefunden : user_pref("CT1320680.InstallationType", "ConduitIntegration");
Gefunden : user_pref("CT1320680.InstalledDate", "Sun Jul 31 2011 20:31:28 GMT+0200");
Gefunden : user_pref("CT1320680.IsGrouping", false);
Gefunden : user_pref("CT1320680.IsInitSetupIni", true);
Gefunden : user_pref("CT1320680.IsMulticommunity", false);
Gefunden : user_pref("CT1320680.IsOpenThankYouPage", false);
Gefunden : user_pref("CT1320680.IsOpenUninstallPage", true);
Gefunden : user_pref("CT1320680.LanguagePackLastCheckTime", "Sun Jul 31 2011 20:31:37 GMT+0200");
Gefunden : user_pref("CT1320680.LanguagePackReloadIntervalMM", 1440);
Gefunden : user_pref("CT1320680.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Gefunden : user_pref("CT1320680.LastLogin_3.5.0.12", "Sun Jul 31 2011 20:31:27 GMT+0200");
Gefunden : user_pref("CT1320680.LatestVersion", "3.3.3.2");
Gefunden : user_pref("CT1320680.Locale", "en-us");
Gefunden : user_pref("CT1320680.MCDetectTooltipHeight", "83");
Gefunden : user_pref("CT1320680.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Gefunden : user_pref("CT1320680.MCDetectTooltipWidth", "295");
Gefunden : user_pref("CT1320680.MyStuffEnabledAtInstallation", true);
Gefunden : user_pref("CT1320680.OriginalFirstVersion", "3.5.0.12");
Gefunden : user_pref("CT1320680.RadioShrinkedFromSetup", false);
Gefunden : user_pref("CT1320680.SearchFromAddressBarIsInit", true);
Gefunden : user_pref("CT1320680.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT132[...]
Gefunden : user_pref("CT1320680.SearchInNewTabEnabled", true);
Gefunden : user_pref("CT1320680.SearchInNewTabIntervalMM", 1440);
Gefunden : user_pref("CT1320680.SearchInNewTabLastCheckTime", "Sun Jul 31 2011 20:31:28 GMT+0200");
Gefunden : user_pref("CT1320680.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Gefunden : user_pref("CT1320680.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]
Gefunden : user_pref("CT1320680.SearchProtectorToolbarDisabled", true);
Gefunden : user_pref("CT1320680.ServiceMapLastCheckTime", "Sun Jul 31 2011 20:31:24 GMT+0200");
Gefunden : user_pref("CT1320680.SettingsLastCheckTime", "Sun Jul 31 2011 20:31:24 GMT+0200");
Gefunden : user_pref("CT1320680.SettingsLastUpdate", "1312121647");
Gefunden : user_pref("CT1320680.ThirdPartyComponentsInterval", 504);
Gefunden : user_pref("CT1320680.ThirdPartyComponentsLastCheck", "Sun Jul 31 2011 20:31:24 GMT+0200");
Gefunden : user_pref("CT1320680.ThirdPartyComponentsLastUpdate", "1246786978");
Gefunden : user_pref("CT1320680.ToolbarShrinkedFromSetup", false);
Gefunden : user_pref("CT1320680.TrusteLinkUrl", "hxxp://trust.conduit.com/CT1320680");
Gefunden : user_pref("CT1320680.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Gefunden : user_pref("CT1320680.UserID", "UN51690285310283966");
Gefunden : user_pref("CT1320680.ValidationData_Toolbar", 0);
Gefunden : user_pref("CT1320680.alertChannelId", "19248");
Gefunden : user_pref("CT1320680.ct1320680.AppTrackingLastCheckTime", "Sun Jul 31 2011 20:31:41 GMT+0200");
Gefunden : user_pref("CT1320680.ct1320680.DialogsAlignMode", "LTR");
Gefunden : user_pref("CT1320680.ct1320680.InvalidateCache", false);
Gefunden : user_pref("CT1320680.ct1320680.LanguagePackLastCheckTime", "Sun Jul 31 2011 20:31:36 GMT+0200");
Gefunden : user_pref("CT1320680.ct1320680.Locale", "en-us");
Gefunden : user_pref("CT1320680.ct1320680.RadioLastCheckTime", "Sun Jul 31 2011 20:31:36 GMT+0200");
Gefunden : user_pref("CT1320680.ct1320680.RadioLastUpdateIPServer", "3");
Gefunden : user_pref("CT1320680.ct1320680.RadioLastUpdateServer", "128929877726170000");
Gefunden : user_pref("CT1320680.ct1320680.SearchInNewTabLastCheckTime", "Sun Jul 31 2011 20:31:30 GMT+0200");
Gefunden : user_pref("CT1320680.ct1320680.SettingsLastCheckTime", "Sun Jul 31 2011 20:31:28 GMT+0200");
Gefunden : user_pref("CT1320680.ct1320680.SettingsLastUpdate", "1312121647");
Gefunden : user_pref("CT1320680.ct1320680.ThirdPartyComponentsLastCheck", "Sun Jul 31 2011 20:31:28 GMT+0200");
Gefunden : user_pref("CT1320680.ct1320680.ThirdPartyComponentsLastUpdate", "1246786978");
Gefunden : user_pref("CT1320680.ct1320680.globalFirstTimeInfoLastCheckTime", "Sun Jul 31 2011 20:31:31 GMT+0200[...]
Gefunden : user_pref("CT1320680.ct1320680.toolbarAppMetaDataLastCheckTime", "Sun Jul 31 2011 20:31:30 GMT+0200"[...]
Gefunden : user_pref("CT1320680.ct1320680.toolbarContextMenuLastCheckTime", "Sun Jul 31 2011 20:31:36 GMT+0200"[...]
Gefunden : user_pref("CT1320680.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Gefunden : user_pref("CT1320680.globalFirstTimeInfoLastCheckTime", "Sun Jul 31 2011 20:31:27 GMT+0200");
Gefunden : user_pref("CT1320680.homepageProtectorEnableByLogin", true);
Gefunden : user_pref("CT1320680.initDone", true);
Gefunden : user_pref("CT1320680.isAppTrackingManagerOn", true);
Gefunden : user_pref("CT1320680.isFirstRadioInstallation", false);
Gefunden : user_pref("CT1320680.myStuffEnabled", true);
Gefunden : user_pref("CT1320680.myStuffPublihserMinWidth", 400);
Gefunden : user_pref("CT1320680.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Gefunden : user_pref("CT1320680.myStuffServiceIntervalMM", 1440);
Gefunden : user_pref("CT1320680.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Gefunden : user_pref("CT1320680.searchProtectorDialogDelayInSec", 10);
Gefunden : user_pref("CT1320680.searchProtectorEnableByLogin", true);
Gefunden : user_pref("CT1320680.testingCtid", "");
Gefunden : user_pref("CT1320680.toolbarAppMetaDataLastCheckTime", "Sun Jul 31 2011 20:31:26 GMT+0200");
Gefunden : user_pref("CT1320680.toolbarContextMenuLastCheckTime", "Sun Jul 31 2011 20:31:34 GMT+0200");
Gefunden : user_pref("CT1320680.usagesFlag", 1);
Gefunden : user_pref("CT2269050.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Gefunden : user_pref("CT2269050.CTID", "CT2269050");
Gefunden : user_pref("CT2269050.CurrentServerDate", "1-11-2010");
Gefunden : user_pref("CT2269050.DialogsAlignMode", "LTR");
Gefunden : user_pref("CT2269050.DownloadReferralCookieData", "");
Gefunden : user_pref("CT2269050.EMailNotifierPollDate", "Mon Nov 01 2010 00:52:46 GMT+0100");
Gefunden : user_pref("CT2269050.FirstServerDate", "31-10-2010");
Gefunden : user_pref("CT2269050.FirstTime", true);
Gefunden : user_pref("CT2269050.FirstTimeFF3", true);
Gefunden : user_pref("CT2269050.FirstTimeSettingsDone", true);
Gefunden : user_pref("CT2269050.FixPageNotFoundErrors", true);
Gefunden : user_pref("CT2269050.GroupingServerCheckInterval", 1440);
Gefunden : user_pref("CT2269050.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Gefunden : user_pref("CT2269050.Initialize", true);
Gefunden : user_pref("CT2269050.InitializeCommonPrefs", true);
Gefunden : user_pref("CT2269050.InstallationAndCookieDataSentCount", 3);
Gefunden : user_pref("CT2269050.InstallationType", "UnknownIntegration");
Gefunden : user_pref("CT2269050.InstalledDate", "Sun Oct 31 2010 20:14:12 GMT+0100");
Gefunden : user_pref("CT2269050.InvalidateCache", false);
Gefunden : user_pref("CT2269050.IsGrouping", false);
Gefunden : user_pref("CT2269050.IsMulticommunity", false);
Gefunden : user_pref("CT2269050.IsOpenThankYouPage", false);
Gefunden : user_pref("CT2269050.IsOpenUninstallPage", false);
Gefunden : user_pref("CT2269050.LanguagePackLastCheckTime", "Sun Oct 31 2010 20:14:18 GMT+0100");
Gefunden : user_pref("CT2269050.LanguagePackReloadIntervalMM", 1440);
Gefunden : user_pref("CT2269050.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Gefunden : user_pref("CT2269050.LastLogin_2.7.2.0", "Mon Nov 01 2010 00:53:05 GMT+0100");
Gefunden : user_pref("CT2269050.LatestVersion", "2.7.2.0");
Gefunden : user_pref("CT2269050.Locale", "en");
Gefunden : user_pref("CT2269050.LoginCache", 4);
Gefunden : user_pref("CT2269050.MCDetectTooltipHeight", "83");
Gefunden : user_pref("CT2269050.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Gefunden : user_pref("CT2269050.MCDetectTooltipWidth", "295");
Gefunden : user_pref("CT2269050.RadioIsPodcast", false);
Gefunden : user_pref("CT2269050.RadioLastCheckTime", "Sun Oct 31 2010 20:14:14 GMT+0100");
Gefunden : user_pref("CT2269050.RadioLastUpdateIPServer", "3");
Gefunden : user_pref("CT2269050.RadioLastUpdateServer", "129132338014870000");
Gefunden : user_pref("CT2269050.RadioMediaID", "12473383");
Gefunden : user_pref("CT2269050.RadioMediaType", "Media Player");
Gefunden : user_pref("CT2269050.RadioMenuSelectedID", "EBRadioMenu_CT226905012473383");
Gefunden : user_pref("CT2269050.RadioStationName", "Hotmix%20108");
Gefunden : user_pref("CT2269050.RadioStationURL", "hxxp://67.202.67.18:8082");
Gefunden : user_pref("CT2269050.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TER[...]
Gefunden : user_pref("CT2269050.SearchFromAddressBarIsInit", true);
Gefunden : user_pref("CT2269050.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT226[...]
Gefunden : user_pref("CT2269050.SearchInNewTabEnabled", true);
Gefunden : user_pref("CT2269050.SearchInNewTabIntervalMM", 1440);
Gefunden : user_pref("CT2269050.SearchInNewTabLastCheckTime", "Sun Oct 31 2010 20:14:14 GMT+0100");
Gefunden : user_pref("CT2269050.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Gefunden : user_pref("CT2269050.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]
Gefunden : user_pref("CT2269050.SettingsCheckIntervalMin", 120);
Gefunden : user_pref("CT2269050.SettingsLastCheckTime", "Mon Nov 01 2010 00:52:45 GMT+0100");
Gefunden : user_pref("CT2269050.SettingsLastUpdate", "1288425627");
Gefunden : user_pref("CT2269050.ThirdPartyComponentsInterval", 504);
Gefunden : user_pref("CT2269050.ThirdPartyComponentsLastCheck", "Sun Oct 31 2010 20:14:10 GMT+0100");
Gefunden : user_pref("CT2269050.ThirdPartyComponentsLastUpdate", "1246790578");
Gefunden : user_pref("CT2269050.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=[...]
Gefunden : user_pref("CT2269050.UserID", "UN65420009540719232");
Gefunden : user_pref("CT2269050.ValidationData_Toolbar", 0);
Gefunden : user_pref("CT2269050.WeatherNetwork", "");
Gefunden : user_pref("CT2269050.WeatherPollDate", "Mon Nov 01 2010 00:52:47 GMT+0100");
Gefunden : user_pref("CT2269050.WeatherUnit", "C");
Gefunden : user_pref("CT2269050.alertChannelId", "666138");
Gefunden : user_pref("CT2269050.clientLogIsEnabled", true);
Gefunden : user_pref("CT2269050.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]
Gefunden : user_pref("CT2269050.myStuffEnabled", true);
Gefunden : user_pref("CT2269050.myStuffPublihserMinWidth", 400);
Gefunden : user_pref("CT2269050.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Gefunden : user_pref("CT2269050.myStuffServiceIntervalMM", 1440);
Gefunden : user_pref("CT2269050.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Gefunden : user_pref("CT2269050.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]
Gefunden : user_pref("CT2431245.DialogsAlignMode", "LTR");
Gefunden : user_pref("CT2431245.IsGrouping", false);
Gefunden : user_pref("CT2431245.LanguagePackLastCheckTime", "Sun Dec 19 2010 23:10:50 GMT+0100");
Gefunden : user_pref("CT2431245.Locale", "de-de");
Gefunden : user_pref("CT2431245.MCDetectTooltipHeight", "83");
Gefunden : user_pref("CT2431245.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Gefunden : user_pref("CT2431245.MCDetectTooltipWidth", "295");
Gefunden : user_pref("CT2431245.SearchInNewTabLastCheckTime", "Sun Dec 19 2010 23:10:50 GMT+0100");
Gefunden : user_pref("CT2431245.SettingsCheckIntervalMin", 120);
Gefunden : user_pref("CT2431245.SettingsLastUpdate", "1291812328");
Gefunden : user_pref("CT2431245.alertChannelId", "825452");
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT1320680", [...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=ct1320680", [...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.5.[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT1320680",[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT1320680&octid=[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=ct1320680&octid=[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/idel.gif", "[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/minimize.gif[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/play.gif", "[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/stop.gif", "[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/vol.gif", "\[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en-us", "\"[...]
Gefunden : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\kevin\\AppData\\Roaming\\Mozilla\\F[...]
Gefunden : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.5.0.12");
Gefunden : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://home.speedbit.com/search.aspx?aff[...]
Gefunden : user_pref("CommunityToolbar.ToolbarsList", "CT2269050,CT1320680");
Gefunden : user_pref("CommunityToolbar.ToolbarsList2", "CT2269050,CT1320680");
Gefunden : user_pref("CommunityToolbar.ToolbarsList4", "CT1320680");
Gefunden : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Sun Oct 31 2010 20:14:15 GMT+0100");
Gefunden : user_pref("CommunityToolbar.globalUserId", "2ac8a7c6-2778-48b3-81bc-6ac83e1d7d0c");
Gefunden : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Gefunden : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Gefunden : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Sun Jul 31 2011 20:31:2[...]
Gefunden : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Gefunden : user_pref("CommunityToolbar.notifications.locale", "en");
Gefunden : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
Gefunden : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sun Jul 31 2011 20:31:23 GMT+0200");
Gefunden : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1305622559");
Gefunden : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Gefunden : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Gefunden : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Gefunden : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Gefunden : user_pref("CommunityToolbar.notifications.userId", "784f731d-44ab-40c6-b1cc-0befeb0a8db1");
Gefunden : user_pref("browser.babylon.HPOnNewTab", "1");
Gefunden : user_pref("browser.newtab.url", "hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf2[...]
Gefunden : user_pref("browser.search.defaulturl", "hxxp://search.babylon.com/web/{searchTerms}?babsrc=browserse[...]
Gefunden : user_pref("browser.search.order.1", "Search the web (Babylon)");
Gefunden : user_pref("browser.search.selectedEngine", "Web Search");
Gefunden : user_pref("browser.startup.homepage", "hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=[...]
Gefunden : user_pref("extensions.BabylonToolbar.cntry", "DE");
Gefunden : user_pref("extensions.BabylonToolbar.firstRun", false);
Gefunden : user_pref("extensions.BabylonToolbar.hdrMd5", "D2453FDEE64F8574FC06D09A7FBA0F61");
Gefunden : user_pref("extensions.BabylonToolbar.lastActv", "19");
Gefunden : user_pref("extensions.BabylonToolbar.lastDP", 19);
Gefunden : user_pref("extensions.helperbar.SmartbarDisabled", false);
Gefunden : user_pref("extensions.helperbar.SmartbarStateMinimaized", false);
Gefunden : user_pref("extensions.toolbar@ask.com.install-event-fired", true);
Gefunden : user_pref("keyword.URL", "hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e[...]
Gefunden : user_pref("speedbit.dap_installed", true);

Datei : C:\Users\Kevo\AppData\Roaming\Mozilla\Firefox\Profiles\scnt2amw.default\prefs.js

Gefunden : user_pref("browser.startup.homepage", "hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=[...]
Gefunden : user_pref("browser.search.selectedEngine", "Web Search");
Gefunden : user_pref("keyword.URL", "hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e[...]
Gefunden : user_pref("browser.newtab.url", "hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf2[...]

-\\ Opera v12.10.1652.0

Datei : C:\Users\kevin\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] Die Datei ist sauber.

Datei : C:\Users\Kevo\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [39949 octets] - [04/07/2013 17:15:36]

########## EOF - C:\AdwCleaner[R1].txt - [40010 octets] ##########

Aneri 04.07.2013 16:33
:hallo:

Mein Name ist Heiko.

Ich habe dein Thema in Arbeit und melde mich so schnell als möglich mit weiteren Anweisungen.

Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Dies garantiert, dass Du Hilfe von einem ausgebildeten Helfer bekommst.

Ich bedanke mich für deine Geduld :)

Aneri 04.07.2013 16:54
:hallo:

Bitte Lesen:
Regeln für die Bereinigung

Eine Bereinigung beinhaltet nebst dem Entfernen von Malware auch das Schließn von Sicherheitslücken und sollte gründlich durchgeführt werden.
Sie erfolgt deshalb in mehreren Schritten und bedeutet einigen Aufwand für dich. Beachte: Das Verschwinden der offensichtlichen Symptome bedeutet nicht, dass das System schon sauber ist.

Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du mit der abarbeitung der Schritte beginnst.
  • :pfui: Beim ersten Anzeichen illegal genutzter Software (Cracks, Patches und Co) wird der Support unterbrochen bis wir wissen wie es weitergeht.
  • Falls es sich bei dem Rechner um einen Firmenrechner handelt teile es mir bitte mit.

  • Bitte arbeite alle Schritte der Reihe nach ab. Gib mir bitte zu jedem Schritt die angeforderte Rückmeldung (Logfile oder Antwort)
    und zwar gesammelt, wenn du alles erledigt hast, in einer Antwort.
  • Bitte führe nur Scanns durch zu denen Du aufgefordert wirst.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder Deinstalliere während der Bereinigung keine Software, ausser Du wurdest dazu von mir oder einem anderen Teammitglied aufgefordert.
  • Poste die Logfiles direkt in deinen Thread (möglichst in Code-Tags - #-Symbol im Editor anklicken). Nicht anhängen oder zippen, außer ich fordere Dich dazu auf, oder das Logfile wäre zu gross. Erschwert mir nämlich das Auswerten.
  • Mache deinen Namen nur dann unkenntlich, wenn es unbedingt sein muss (erleichtert uns die Arbeit).
  • Sollte ich nicht nach 3 Tagen geantwortet haben, dann (und nur dann) schicke mir bitte eine PM.
  • Ich werde dir ganz deutlich mitteilen, dass du "sauber" bist. Bis dahin arbeite bitte gut mit.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.


Dann fangen wir mal mit Schritt 1 an:

Systemscan mit FRST
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Scan.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

kevinanthony 04.07.2013 17:14
Danke für die schnelle Hilfe , hier sind die Anhänge.


FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 04-07-2013
Ran by kevin (administrator) on 04-07-2013 18:02:18
Running from C:\Users\kevin\Desktop
Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Could not list processes ===============

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [InstalledTime] 4-14-2013 [x]
HKLM\...\Run: [AVG_UI] "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY [3147384 2012-12-11] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox]  ATTENTION! ====> ZeroAccess
HKCU\...\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot [3491264 2012-06-10] (Tonec Inc.)
HKCU\...\Run: [GPU Tweak Main] C:\Program Files\ASUS\GPU Tweak\GPUTweak.exe [3268608 2013-05-16] (ASUS)
HKCU\...\Run: [Iwboavxoip] C:\Users\kevin\AppData\Roaming\Kuosxu\ubent.exe [x]
HKCU\...\Run: [IExplorer Util] C:\Users\kevin\AppData\Roaming\ie_util.exe [x]
HKCU\...\Run: [Remote Control Server] C:\Program Files\Remote Control Server\Remote Control Server.exe [2221056 2013-06-07] (Steppschuh)
HKCU\...\Run: [Browser Infrastructure Helper] C:\Users\kevin\AppData\Local\Smartbar\Application\Linkury.exe startup [x]
HKCU\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2012-07-15] (Google Inc.)
HKCU\...\Run: [ProxifyTrayApp] C:\Program Files\Proxify Tray Application\Proxify Tray Application.exe [2689536 2013-02-27] (UpsideOut, Inc.)
HKCU\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [19604072 2013-06-03] (Skype Technologies S.A.)
HKCU\...\Winlogon: [Shell] explorer.exe,C:\Users\kevin\AppData\Roaming\skype.dat <==== ATTENTION
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
MountPoints2: {032d63d6-4b98-11e1-bc14-806e6f6e6963} - D:\Autorun.exe
HKU\Kevo\...\Run: [Iwboavxoip] C:\Users\Kevo\AppData\Roaming\Kuosxu\ubent.exe [x]
HKU\Kevo\...\Run: [Remote Control Server] C:\Program Files\Remote Control Server\Remote Control Server.exe [ 2013-06-07] (Steppschuh)
HKU\Kevo\...\Run: [GPU Tweak Main] C:\Program Files\ASUS\GPU Tweak\GPUTweak.exe [ 2013-05-16] (ASUS)
HKU\Kevo\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [ 2013-06-03] (Skype Technologies S.A.)
HKU\Kevo\...\Run: [Nyciihi] C:\Users\Kevo\AppData\Roaming\Efuhuw\apum.exe [x]
HKU\Kevo\...\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot [ 2012-06-10] (Tonec Inc.)
HKU\Kevo\...\Policies\system: [LogonHoursAction] 2
HKU\Kevo\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Kevo\...\Winlogon: [Shell] explorer.exe <==== ATTENTION
Startup: C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
ShortcutTarget: Facebook Messenger.lnk -> C:\Users\kevin\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe (Facebook)
Startup: C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk
ShortcutTarget: regmonstd.lnk -> C:\Users\kevin\AppData\Local\Temp\vivvlqripwqvcenacxu.bfg (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}&installDate=01/01/1970
SearchScopes: HKLM - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}&installDate=01/01/1970
HKCU SearchScopes: DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}&installDate=01/01/1970
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}&installDate=01/01/1970
BHO: IDM integration (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
BHO: Linkury SmartbarEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Linkury Smartbar - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -No Name - {30F9B915-B755-4826-820B-08FBA6BD249D} -  No File
Toolbar: HKCU -No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} -  No File
Toolbar: HKCU -No Name - {B80F591E-FE9A-46CF-A13E-180377240586} -  No File
Toolbar: HKCU -No Name - {F92A9FE4-2850-4198-B9D5-279880E49B16} -  No File
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/121022/CTPID.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\15.1.0\ViProtocol.dll No File
Winsock: Catalog5 05 %SystemRoot%\system32\PrxerNsp.dll [61440] (Initex Software)
Winsock: Catalog5 06 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)

Hosts: Hosts file not detected in the default directory
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default
FF user.js: detected! => C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\user.js
FF NewTab: hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=nt&babsrc=lnkry_nt&installDate=01/01/1970&q=
FF SelectedSearchEngine: Web Search
FF Homepage: hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=hp&babsrc=lnkry&installDate=01/01/1970
FF Keyword.URL: hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=ds&babsrc=lnkry&installDate=01/01/1970&q=
FF NetworkProxy: "backup.ftp", "securewebproxy.org"
FF NetworkProxy: "backup.ftp_port", 1111
FF NetworkProxy: "backup.gopher", "securewebproxy.org"
FF NetworkProxy: "backup.gopher_port", 1111
FF NetworkProxy: "backup.socks", "securewebproxy.org"
FF NetworkProxy: "backup.socks_port", 1111
FF NetworkProxy: "backup.ssl", "securewebproxy.org"
FF NetworkProxy: "backup.ssl_port", 1111
FF NetworkProxy: "ftp", "securewebproxy.org"
FF NetworkProxy: "ftp_port", 1111
FF NetworkProxy: "gopher", "securewebproxy.org"
FF NetworkProxy: "gopher_port", 1111
FF NetworkProxy: "http", "securewebproxy.org"
FF NetworkProxy: "http_port", 1111
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "securewebproxy.org"
FF NetworkProxy: "socks_port", 1111
FF NetworkProxy: "ssl", "securewebproxy.org"
FF NetworkProxy: "ssl_port", 1111
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\15.1.0\\npsitesafety.dll No File
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @esn.me/esnsonar,version=0.70.4 - C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin: @esn/esnlaunch,version=2.1.7 - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin: @java.com/DTPlugin,version=1.6.0_33 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\kevin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\kevin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: facebook.com/fbDesktopPlugin - C:\Users\kevin\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
FF SearchPlugin: C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\searchplugins\Web Search.xml
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Elite Proxy Switcher - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\eliteproxyswitcher@my-proxy.com
FF Extension: Ask Toolbar - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\toolbar@ask.com
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{88cdf226-1a4e-467b-aa5d-1c2c70bbadc0}
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF Extension: DownloadHelper - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] C:\Users\kevin\AppData\Roaming\5059
FF Extension: Java String Helper - C:\Users\kevin\AppData\Roaming\5059
FF HKLM\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF HKCU\...\Firefox\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF HKCU\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] C:\Users\kevin\AppData\Roaming\5059
FF Extension: Java String Helper - C:\Users\kevin\AppData\Roaming\5059
FF HKCU\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5

========================== Services (Whitelisted) =================

S2 avgfws; C:\Program Files\AVG\AVG2013\avgfws.exe [1342024 2012-12-10] (AVG Technologies CZ, s.r.o.)
S2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [5814904 2012-11-15] (AVG Technologies CZ, s.r.o.)
S2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [196664 2012-10-22] (AVG Technologies CZ, s.r.o.)
S4 BstHdAndroidSvc; C:\Program Files\BlueStacks\HD-Service.exe [397704 2012-05-31] (BlueStack Systems, Inc.)
S4 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [385416 2012-05-31] (BlueStack Systems, Inc.)
S4 Connectify; C:\Program Files\Connectify\ConnectifyService.exe [65536 2012-05-02] ()
S4 CPUCooLServer; C:\Program Files\CPUCooL\CooLSrv.exe [743936 2011-12-01] ()
S4 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2010-09-17] (Creative Labs)
S4 Creative Media Toolbox 6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\MT6Licensing.exe [79360 2010-08-02] (Creative Labs)
S4 EMP_UDSA; C:\Program Files\EPSON Projector\Epson USB Display V1.5\EMP_UDSA.exe [98304 2011-01-06] (SEIKO EPSON CORPORATION)
R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG)
S4 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®)
S4 Futuremark SystemInfo Service; C:\Program Files\Futuremark\Futuremark SystemInfo\FMSISvc.exe [137488 2012-12-17] (Futuremark Corporation)
S4 GtDetectSc; C:\Program Files\Option\Option WWAN Driver 5.0.32.0 Installer\GtDetectSc.exe [545792 2009-05-04] (OptionNV)
S4 HauppaugeTVServer; C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe [558592 2010-11-03] (Hauppauge Computer Works)
S4 HerculesDJControlMP3; C:\Program Files\Hercules\Audio\DJ Console Series\drivers\x86\HerculesDJControlMP3.EXE [17408 2010-12-23] ()
S4 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [655944 2012-07-03] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation)
S4 npggsvc; C:\Windows\system32\GameMon.des [3890920 2010-06-17] (INCA Internet Co., Ltd.)
S4 NWHelper; C:\Program Files\Novatel Wireless\Drivers\NWHelper.exe [193824 2009-12-04] (Novatel Wireless Inc.)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2013-04-29] ()
S4 Realtek11nCU; C:\Program Files\SITECOM\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-17] (Realtek)
S4 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S4 Sony Ericsson PCCompanion; C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [150528 2011-02-10] (Avanquest Software)
S4 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [201344 2012-01-10] (Telefónica)
S4 UI Assistant Service; C:\Program Files\Mobile Partner Manager\AssistantServices.exe [241664 2009-03-24] ()
S4 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
S4 VMCService; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [9216 2009-04-20] (Vodafone)
S2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [x]
S4 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x]
S2 vToolbarUpdater15.1.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.1.0\ToolbarUpdater.exe [x]

==================== Drivers (Whitelisted) ====================

R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [34592 2013-05-03] (AVG Technologies)
R2 BstHdDrv; C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [66952 2012-05-31] (BlueStack Systems)
R3 Bulk; C:\Windows\System32\Drivers\HDJBulk.sys [153600 2010-12-23] (© Guillemot R&D, 2010. All rights reserved.)
S1 cnnctfy2; C:\Windows\System32\DRIVERS\cnnctfy2.sys [27248 2012-07-03] (Connectify)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [219352 2009-06-05] (Intel Corporation)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [867344 2012-11-14] (<Turtle Entertainment>)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R3 hcw17bda; C:\Windows\System32\drivers\hcw17bda.sys [54016 2010-01-27] (Hauppauge Computer Works, Inc.)
R3 HDJMidi; C:\Windows\System32\DRIVERS\HDJMidi.sys [192000 2010-12-23] (© Guillemot R&D, 2010. All rights reserved.)
R3 ksaud; C:\Windows\System32\drivers\ksaud.sys [899712 2011-07-06] (Creative Technology Ltd.)
S3 LVPr2Mon; C:\Windows\System32\Drivers\LVPr2Mon.sys [25824 2010-05-07] ()
R1 MagicTune; C:\Windows\system32\drivers\MTiCtwl.sys [14336 2010-04-22] (Samsung Electronics, Inc. )
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [9728 2009-02-03] (ZTE Incorporated)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22344 2012-07-03] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
R1 MpKsl1dd73574; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F94C38AE-C066-419C-8A78-C2656981C18B}\MpKsl1dd73574.sys [29904 2013-07-04] (Microsoft Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
R1 ntiopnp; C:\Windows\System32\Drivers\ntiopnp.sys [21080 2010-11-11] ()
R1 ntiowp; C:\Windows\System32\Drivers\ntiowp.sys [12352 2006-10-20] ()
S3 NVFLASH; C:\Windows\system32\drivers\nvflash.sys [12864 2012-03-10] ()
S3 NVR0Dev; C:\Windows\nvoclock.sys [6912 2006-10-31] (NVidia Corp.)
S3 pneteth; C:\Windows\System32\DRIVERS\pneteth.sys [13312 2011-07-19] (June Fabrics Technology Inc.)
S3 PRODIGY; C:\Windows\System32\Drivers\PRODIGY.SYS [32377 2006-08-29] (B-phreaks)
R2 PStrip; C:\Windows\system32\DRIVERS\PSTRIP.SYS [27992 2007-07-15] (EnTech Taiwan)
S3 RivaTuner32; C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys [9088 2009-08-22] ()
R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-29] (Almico Software)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 clwvd; system32\DRIVERS\clwvd.sys [x]
S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x32.sys [x]
S3 UCORESYS; \??\C:\Users\Kevo\Desktop\UCORESYS.SYS [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-04 18:01 - 2013-07-04 18:01 - 00000000 ____D C:\FRST
2013-07-04 17:59 - 2013-07-04 18:00 - 01373373 ____A (Farbar) C:\Users\kevin\Desktop\FRST.exe
2013-07-04 17:15 - 2013-07-04 17:16 - 00040080 ____A C:\AdwCleaner[R1].txt
2013-07-04 17:13 - 2013-07-04 17:13 - 00650027 ____A C:\Users\kevin\Desktop\adwcleaner.exe
2013-07-04 15:29 - 2013-07-04 15:29 - 00000000 ____A C:\Users\kevin\Downloads\Fall Out Boy Ft[1]. Lil Wayne, Lupe Fiasco, Kanye West, Travis (of Gym Class Heroes), Tyga, Paul Wall, & Skin Head Rob) - This Aint A Scene, It An Arms Race (Rem
2013-07-04 13:02 - 2013-07-04 13:02 - 21703480 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 22.0.exe
2013-07-03 13:36 - 2013-07-03 13:36 - 00014212 ____A C:\Users\kevin\Desktop\hs_err_pid3876.log
2013-07-02 18:52 - 2013-07-02 18:52 - 00000000 ____D C:\Users\Kevo\AppData\Local\Avg2013
2013-07-02 02:02 - 2013-07-02 02:02 - 00000004 ____A C:\Users\kevin\AppData\Roaming\skype.ini
2013-06-30 09:26 - 2013-06-30 09:26 - 00000000 ____D C:\Users\kevin\AppData\Local\{B2B348CF-713B-454E-AF1F-88D90571896E}
2013-06-30 09:21 - 2013-01-18 16:21 - 04133664 ____A (NVIDIA Corporation) C:\Windows\System32\nvcpl.dll
2013-06-30 09:21 - 2013-01-18 16:21 - 03005728 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvc.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 02953448 ____A C:\Windows\System32\nvcoproc.bin
2013-06-30 09:21 - 2013-01-18 16:20 - 02557728 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvcr.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 00639776 ____A (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
2013-06-30 09:21 - 2013-01-18 16:20 - 00108832 ____A (NVIDIA Corporation) C:\Windows\System32\nvmctray.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 00062752 ____A (NVIDIA Corporation) C:\Windows\System32\nvshext.dll
2013-06-30 09:20 - 2013-06-30 09:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-06-30 08:57 - 2013-06-30 08:59 - 171934904 ____A (NVIDIA Corporation) C:\Users\kevin\Desktop\314.22-desktop-win8-win7-winvista-32bit-international-whql.exe
2013-06-30 08:04 - 2013-06-30 08:04 - 00000000 ____D C:\ProgramData\AVG2013
2013-06-29 07:39 - 2013-06-29 07:39 - 00000000 ____D C:\Users\kevin\AppData\Roaming\AVG2013
2013-06-29 07:33 - 2013-06-29 07:33 - 00000000 ____D C:\Users\kevin\AppData\Local\Avg2013
2013-06-27 03:11 - 2013-06-27 03:11 - 00000000 ____D C:\Program Files\Proxify Tray Application
2013-06-24 23:54 - 2013-06-24 23:54 - 00001188 ____A C:\Users\kevin\Desktop\iSRO - Verknüpfung.lnk
2013-06-23 09:20 - 2013-06-23 09:21 - 95023320 ___AT C:\ProgramData\i8irl.pad
2013-06-23 09:20 - 2013-06-23 09:20 - 00044544 ____A (Microsoft Corporation) C:\ProgramData\rundll32.exe
2013-06-23 09:20 - 2013-06-23 09:20 - 00000000 ____A C:\ProgramData\as98213.txt
2013-06-23 08:43 - 2013-06-23 08:43 - 00001105 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\ProgramData\Mozilla
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-23 08:42 - 2013-06-23 08:42 - 21151576 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 21.0.exe
2013-06-23 08:19 - 2013-06-24 23:54 - 00000000 ____D C:\Program Files\iSRO
2013-06-23 08:01 - 2013-06-23 08:16 - 1783991173 ____A C:\Users\kevin\Downloads\iSRO_286(2).exe
2013-06-22 23:31 - 2013-06-22 23:31 - 00000000 ____D C:\Users\kevin\AppData\Local\{C0DD6DF3-7E5F-495F-BC91-ED1CF71F38A8}
2013-06-22 03:07 - 2013-06-22 03:07 - 00000000 ____D C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-21 23:38 - 2013-06-21 23:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{A152DDA7-9317-45C6-8EF5-B86ED556741E}
2013-06-21 01:08 - 2013-06-22 02:08 - 00000000 ____D C:\451c327abcef803d4ba49df94c30
2013-06-20 00:31 - 2013-06-22 01:53 - 95023320 ___AT C:\ProgramData\inqbin.pad
2013-06-20 00:31 - 2013-06-21 23:36 - 00000000 ____A C:\ProgramData\kjhy64.txt
2013-06-20 00:31 - 2013-06-20 00:31 - 00141312 ____A C:\ProgramData\nibqni.dat
2013-06-20 00:20 - 2013-06-20 00:20 - 00026760 ____A C:\Users\kevin\Downloads\bitshare_default.xml
2013-06-19 23:10 - 2013-06-19 23:10 - 00000000 ____D C:\Users\kevin\AppData\Local\{11E16F19-44CF-4006-B8C0-0E752F9E9D17}
2013-06-15 16:45 - 2013-06-15 16:46 - 00000000 ____D C:\Users\kevin\AppData\Local\{DCB07B9B-1C60-473E-A594-F2F334CCDEAC}
2013-06-15 01:05 - 2013-06-15 01:05 - 00000000 ____D C:\Users\kevin\AppData\Local\{3CF6A213-4817-42E6-A4CB-3FD56676B4D4}
2013-06-14 15:59 - 2013-06-13 21:14 - 00000000 ____D C:\Users\kevin\Desktop\BEST OF MAY 2013
2013-06-14 10:23 - 2013-06-14 10:23 - 00000000 ____D C:\Users\kevin\AppData\Local\{77A77206-43F3-416C-97A7-0146DF373D92}
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\589457bd5c299aeeab
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\37449d796b34a549f81a698d2ff0250b
2013-06-14 03:13 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-14 03:13 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-14 03:04 - 2013-06-14 03:12 - 00000000 ____D C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 03:37 - 2013-06-13 15:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{683C7EE4-369F-486F-9646-3D187EE7302F}
2013-06-13 03:22 - 2013-06-13 03:23 - 00086330 ____A C:\hcwDriverInstall.txt
2013-06-13 03:22 - 2010-01-18 14:01 - 00098384 ____A C:\Windows\System32\Drivers\hcw17isd.1b0
2013-06-13 03:22 - 2009-12-09 13:43 - 00101056 ____A C:\Windows\System32\Drivers\hcw17dvb.1b0
2013-06-13 03:22 - 2009-08-11 14:35 - 00249856 ____A (Siano Mobile Silicon) C:\Windows\System32\HcwSmsCt.dll
2013-06-13 03:20 - 2013-06-13 03:20 - 00000000 ____D C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-13 03:19 - 2013-06-13 03:20 - 00173502 ____A C:\hcwclear.txt
2013-06-13 03:19 - 2013-05-17 03:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 03:19 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 03:19 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 09:01 - 2013-06-15 00:59 - 00001979 ____A C:\Users\Public\Desktop\Remote Control Server.lnk
2013-06-12 09:01 - 2013-06-12 09:01 - 00000000 ____D C:\Program Files\Remote Control Server
2013-06-12 08:54 - 2013-06-12 08:54 - 00000000 ____D C:\Users\kevin\Desktop\RNB4U.in - Best of May 2013
2013-06-12 02:24 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 02:24 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 02:24 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 02:23 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 02:23 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 02:23 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 02:23 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 02:23 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 02:23 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-11 22:38 - 2013-06-11 22:38 - 00006890 ____A C:\OFB-EAST109546437.pkg
2013-06-11 22:20 - 2013-06-11 22:21 - 07944668 ____A C:\Users\kevin\Desktop\Baldgroßeronkel Mo Woodpacker.flv
2013-06-11 21:13 - 2013-06-11 21:13 - 00000975 ____A C:\Windows\System32\Drivers\etc\hosts.txt
2013-06-08 04:28 - 2013-06-08 04:28 - 00000000 ____D C:\Users\kevin\AppData\Local\NVIDIA
2013-06-08 04:20 - 2013-02-25 07:27 - 00154400 ____A (NVIDIA Corporation) C:\Windows\System32\Drivers\nvhda32v.sys
2013-06-08 04:20 - 2013-02-25 07:27 - 00028448 ____A (NVIDIA Corporation) C:\Windows\System32\nvhdap32.dll
2013-06-06 20:24 - 2013-06-06 20:25 - 00000000 ____D C:\Users\kevin\AppData\Local\{F7EFB78D-E40A-49F4-A17E-5302E8B17273}

==================== One Month Modified Files and Folders ========

2013-07-04 18:02 - 2012-07-15 20:32 - 00001096 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-04 18:01 - 2013-07-04 18:01 - 00000000 ____D C:\FRST
2013-07-04 18:00 - 2013-07-04 17:59 - 01373373 ____A (Farbar) C:\Users\kevin\Desktop\FRST.exe
2013-07-04 18:00 - 2011-09-13 20:56 - 00000928 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001UA.job
2013-07-04 17:37 - 2012-04-19 20:36 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-04 17:24 - 2009-07-14 10:56 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-07-04 17:16 - 2013-07-04 17:15 - 00040080 ____A C:\AdwCleaner[R1].txt
2013-07-04 17:15 - 2010-06-09 20:58 - 00000000 ____D C:\Users\kevin\AppData\Roaming\DMCache
2013-07-04 17:13 - 2013-07-04 17:13 - 00650027 ____A C:\Users\kevin\Desktop\adwcleaner.exe
2013-07-04 15:29 - 2013-07-04 15:29 - 00000000 ____A C:\Users\kevin\Downloads\Fall Out Boy Ft[1]. Lil Wayne, Lupe Fiasco, Kanye West, Travis (of Gym Class Heroes), Tyga, Paul Wall, & Skin Head Rob) - This Aint A Scene, It An Arms Race (Rem
2013-07-04 14:46 - 2013-02-08 08:48 - 01857718 ____A C:\Windows\WindowsUpdate.log
2013-07-04 13:34 - 2009-07-14 06:34 - 00015152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-04 13:34 - 2009-07-14 06:34 - 00015152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-04 13:29 - 2012-07-15 20:32 - 00001092 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-04 13:26 - 2013-04-05 23:30 - 07163736 ____A C:\Windows\setupact.log
2013-07-04 13:26 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-04 13:03 - 2010-06-14 22:25 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-07-04 13:02 - 2013-07-04 13:02 - 21703480 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 22.0.exe
2013-07-04 13:00 - 2010-12-02 21:26 - 00000000 ____D C:\Users\kevin\AppData\Roaming\Skype
2013-07-04 12:56 - 2011-08-02 01:11 - 00000000 ____D C:\Program Files\Origin
2013-07-04 12:51 - 2012-02-01 22:54 - 00291088 ____A C:\Windows\System32\PnkBstrB.xtr
2013-07-04 12:51 - 2010-12-27 20:52 - 00291088 ____A C:\Windows\System32\PnkBstrB.exe
2013-07-04 12:51 - 2010-12-27 20:52 - 00137992 ____A C:\Windows\System32\Drivers\PnkBstrK.sys
2013-07-04 12:50 - 2010-12-27 20:52 - 00280904 ____A C:\Windows\System32\PnkBstrB.ex0
2013-07-04 03:23 - 2013-02-08 06:49 - 01607382 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-04 03:18 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-04 00:00 - 2011-09-13 20:56 - 00000906 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001Core.job
2013-07-03 13:36 - 2013-07-03 13:36 - 00014212 ____A C:\Users\kevin\Desktop\hs_err_pid3876.log
2013-07-02 19:56 - 2010-09-18 15:19 - 00000000 ____D C:\Users\kevin\Documents\VirtualDJ
2013-07-02 18:56 - 2010-06-10 22:15 - 00000000 ____D C:\Users\kevin\Desktop\bilder
2013-07-02 18:55 - 2012-12-13 22:03 - 00000000 ____D C:\Users\Kevo\AppData\Roaming\DMCache
2013-07-02 18:53 - 2012-07-05 21:43 - 00000000 ____D C:\Users\Kevo\AppData\Roaming\Skype
2013-07-02 18:52 - 2013-07-02 18:52 - 00000000 ____D C:\Users\Kevo\AppData\Local\Avg2013
2013-07-02 18:51 - 2013-02-08 13:41 - 00000680 _RASH C:\Users\Kevo\ntuser.pol
2013-07-02 18:51 - 2013-02-08 06:51 - 00000000 ____D C:\users\Kevo
2013-07-02 02:02 - 2013-07-02 02:02 - 00000004 ____A C:\Users\kevin\AppData\Roaming\skype.ini
2013-06-30 15:08 - 2010-12-02 21:26 - 00000000 ____D C:\ProgramData\Skype
2013-06-30 14:53 - 2010-06-09 18:37 - 00000000 ____D C:\Program Files\Windows Live
2013-06-30 14:51 - 2009-07-14 04:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-06-30 09:26 - 2013-06-30 09:26 - 00000000 ____D C:\Users\kevin\AppData\Local\{B2B348CF-713B-454E-AF1F-88D90571896E}
2013-06-30 09:24 - 2010-06-09 19:07 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-30 09:21 - 2010-06-09 18:34 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-06-30 09:20 - 2013-06-30 09:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-06-30 09:17 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\DriverStore
2013-06-30 08:59 - 2013-06-30 08:57 - 171934904 ____A (NVIDIA Corporation) C:\Users\kevin\Desktop\314.22-desktop-win8-win7-winvista-32bit-international-whql.exe
2013-06-30 08:41 - 2013-06-08 04:28 - 00000000 ____D C:\Users\kevin\AppData\Local\NVIDIA
2013-06-30 08:04 - 2013-06-30 08:04 - 00000000 ____D C:\ProgramData\AVG2013
2013-06-29 15:44 - 2011-03-01 19:17 - 00000000 ____D C:\Program Files\Steam
2013-06-29 07:39 - 2013-06-29 07:39 - 00000000 ____D C:\Users\kevin\AppData\Roaming\AVG2013
2013-06-29 07:33 - 2013-06-29 07:33 - 00000000 ____D C:\Users\kevin\AppData\Local\Avg2013
2013-06-27 03:11 - 2013-06-27 03:11 - 00000000 ____D C:\Program Files\Proxify Tray Application
2013-06-26 14:12 - 2012-08-03 12:02 - 00000000 ____D C:\Users\kevin\Downloads\Video
2013-06-25 01:19 - 2013-04-26 18:27 - 00007270 ____A C:\Windows\PFRO.log
2013-06-25 00:57 - 2013-04-03 20:25 - 00000000 ____D C:\Program Files\Futuremark
2013-06-25 00:57 - 2010-06-09 19:21 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-06-24 23:59 - 2013-05-03 02:01 - 00000000 ____D C:\ProgramData\MFAData
2013-06-24 23:54 - 2013-06-24 23:54 - 00001188 ____A C:\Users\kevin\Desktop\iSRO - Verknüpfung.lnk
2013-06-24 23:54 - 2013-06-23 08:19 - 00000000 ____D C:\Program Files\iSRO
2013-06-23 09:21 - 2013-06-23 09:20 - 95023320 ___AT C:\ProgramData\i8irl.pad
2013-06-23 09:20 - 2013-06-23 09:20 - 00044544 ____A (Microsoft Corporation) C:\ProgramData\rundll32.exe
2013-06-23 09:20 - 2013-06-23 09:20 - 00000000 ____A C:\ProgramData\as98213.txt
2013-06-23 08:43 - 2013-06-23 08:43 - 00001105 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\ProgramData\Mozilla
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-23 08:42 - 2013-06-23 08:42 - 21151576 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 21.0.exe
2013-06-23 08:16 - 2013-06-23 08:01 - 1783991173 ____A C:\Users\kevin\Downloads\iSRO_286(2).exe
2013-06-22 23:31 - 2013-06-22 23:31 - 00000000 ____D C:\Users\kevin\AppData\Local\{C0DD6DF3-7E5F-495F-BC91-ED1CF71F38A8}
2013-06-22 08:33 - 2013-02-08 20:20 - 00000680 _RASH C:\Users\kevin\ntuser.pol
2013-06-22 08:33 - 2013-02-08 06:51 - 00000000 ____D C:\users\kevin
2013-06-22 03:07 - 2013-06-22 03:07 - 00000000 ____D C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-22 02:11 - 2012-06-15 02:03 - 00000000 ____D C:\Program Files\BlueStacks
2013-06-22 02:11 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\wfp
2013-06-22 02:08 - 2013-06-21 01:08 - 00000000 ____D C:\451c327abcef803d4ba49df94c30
2013-06-22 02:08 - 2012-07-15 22:09 - 00000000 ____D C:\Users\kevin\AppData\Roaming\MyPhoneExplorer
2013-06-22 02:08 - 2012-06-15 02:03 - 00000000 ____D C:\Users\kevin\AppData\Local\BlueStacks
2013-06-22 02:08 - 2011-08-02 01:11 - 00000000 ____D C:\ProgramData\Origin
2013-06-22 02:08 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\AppCompat
2013-06-22 02:07 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration
2013-06-22 02:01 - 2010-10-28 06:55 - 00000000 ____D C:\Program Files\gPotato.eu
2013-06-22 01:53 - 2013-06-20 00:31 - 95023320 ___AT C:\ProgramData\inqbin.pad
2013-06-22 00:24 - 2012-06-15 02:03 - 00000000 ____D C:\ProgramData\BlueStacks
2013-06-21 23:38 - 2013-06-21 23:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{A152DDA7-9317-45C6-8EF5-B86ED556741E}
2013-06-21 23:36 - 2013-06-20 00:31 - 00000000 ____A C:\ProgramData\kjhy64.txt
2013-06-20 00:31 - 2013-06-20 00:31 - 00141312 ____A C:\ProgramData\nibqni.dat
2013-06-20 00:20 - 2013-06-20 00:20 - 00026760 ____A C:\Users\kevin\Downloads\bitshare_default.xml
2013-06-19 23:10 - 2013-06-19 23:10 - 00000000 ____D C:\Users\kevin\AppData\Local\{11E16F19-44CF-4006-B8C0-0E752F9E9D17}
2013-06-15 16:46 - 2013-06-15 16:45 - 00000000 ____D C:\Users\kevin\AppData\Local\{DCB07B9B-1C60-473E-A594-F2F334CCDEAC}
2013-06-15 16:43 - 2013-04-29 10:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins
2013-06-15 01:05 - 2013-06-15 01:05 - 00000000 ____D C:\Users\kevin\AppData\Local\{3CF6A213-4817-42E6-A4CB-3FD56676B4D4}
2013-06-15 00:59 - 2013-06-12 09:01 - 00001979 ____A C:\Users\Public\Desktop\Remote Control Server.lnk
2013-06-15 00:38 - 2012-12-14 00:35 - 00000000 ____D C:\Users\kevin\Desktop\beats
2013-06-15 00:38 - 2010-06-10 22:18 - 00000000 ___RD C:\Users\kevin\Desktop\Programme
2013-06-14 10:23 - 2013-06-14 10:23 - 00000000 ____D C:\Users\kevin\AppData\Local\{77A77206-43F3-416C-97A7-0146DF373D92}
2013-06-14 08:40 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-06-14 07:43 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\589457bd5c299aeeab
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\37449d796b34a549f81a698d2ff0250b
2013-06-14 03:12 - 2013-06-14 03:04 - 00000000 ____D C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 21:14 - 2013-06-14 15:59 - 00000000 ____D C:\Users\kevin\Desktop\BEST OF MAY 2013
2013-06-13 18:59 - 2012-05-25 21:51 - 00000000 ___RD C:\Program Files\Skype
2013-06-13 15:38 - 2013-06-13 03:37 - 00000000 ____D C:\Users\kevin\AppData\Local\{683C7EE4-369F-486F-9646-3D187EE7302F}
2013-06-13 03:37 - 2012-04-19 20:36 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-13 03:37 - 2011-12-08 01:13 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-13 03:23 - 2013-06-13 03:22 - 00086330 ____A C:\hcwDriverInstall.txt
2013-06-13 03:20 - 2013-06-13 03:20 - 00000000 ____D C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-13 03:20 - 2013-06-13 03:19 - 00173502 ____A C:\hcwclear.txt
2013-06-13 03:20 - 2013-02-08 14:40 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 03:19 - 2010-06-09 19:21 - 00000000 ____D C:\Windows\System32\Hauppauge
2013-06-13 01:23 - 2013-04-14 22:56 - 00001001 ____A C:\Users\Public\Desktop\ASUS GPU Tweak.lnk
2013-06-13 01:21 - 2011-01-06 04:31 - 00000000 ____D C:\Windows\Downloaded Installations
2013-06-12 09:01 - 2013-06-12 09:01 - 00000000 ____D C:\Program Files\Remote Control Server
2013-06-12 08:57 - 2012-07-02 22:15 - 00000000 ____D C:\Users\kevin\AppData\Local\Downloaded Installations
2013-06-12 08:54 - 2013-06-12 08:54 - 00000000 ____D C:\Users\kevin\Desktop\RNB4U.in - Best of May 2013
2013-06-12 02:02 - 2013-02-08 13:44 - 00113528 ____A C:\Users\Kevo\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-11 22:38 - 2013-06-11 22:38 - 00006890 ____A C:\OFB-EAST109546437.pkg
2013-06-11 22:21 - 2013-06-11 22:20 - 07944668 ____A C:\Users\kevin\Desktop\Baldgroßeronkel Mo Woodpacker.flv
2013-06-11 21:13 - 2013-06-11 21:13 - 00000975 ____A C:\Windows\System32\Drivers\etc\hosts.txt
2013-06-08 13:42 - 2013-06-14 03:13 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 13:40 - 2013-06-14 03:13 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 13:40 - 2013-06-14 03:13 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 13:40 - 2013-06-14 03:13 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 13:40 - 2013-06-14 03:13 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 13:13 - 2013-06-14 03:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 04:40 - 2011-08-02 01:14 - 00000000 ____D C:\Users\kevin\AppData\Roaming\Origin
2013-06-08 04:40 - 2011-08-02 01:14 - 00000000 ____D C:\Users\kevin\AppData\Local\Origin
2013-06-07 08:03 - 2012-10-19 06:02 - 00000000 ____D C:\Users\kevin\Desktop\aktuellere lieder
2013-06-06 20:34 - 2011-08-30 19:46 - 00000000 ____D C:\aktuelle lieder
2013-06-06 20:25 - 2013-06-06 20:24 - 00000000 ____D C:\Users\kevin\AppData\Local\{F7EFB78D-E40A-49F4-A17E-5302E8B17273}

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$fd72f31c638f0885e43ce044e4f81431

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$fd72f31c638f0885e43ce044e4f81431

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-3072820278-2867077185-342124202-1007\$fd72f31c638f0885e43ce044e4f81431

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$fd72f31c638f0885e43ce044e4f81431

Files to move or delete:
====================
C:\ProgramData\rundll32.exe
C:\Users\kevin\AppData\Roaming\skype.dat
C:\Users\kevin\AppData\Roaming\skype.ini
C:\Users\Kevo\AppData\Roaming\skype.dat
C:\Users\Kevo\AppData\Roaming\skype.ini
C:\ProgramData\i8irl.pad
C:\ProgramData\inqbin.pad
C:\ProgramData\nibqni.dat

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-03 14:49

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---


Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 04-07-2013
Ran by kevin at 2013-07-04 18:04:30
Running from C:\Users\kevin\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

.NET Utilities (Version: 128.0.0)
Adobe AIR (Version: 2.7.0.19530)
Adobe Flash Player 11 ActiveX (Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (Version: 11.3.300.271)
Adobe Reader XI (11.0.03) - Deutsch (Version: 11.0.03)
Apple Application Support (Version: 2.2.2)
Apple Mobile Device Support (Version: 6.0.0.59)
Apple Software Update (Version: 2.1.3.127)
ASIO4ALL
Ask Toolbar (Version: 1.15.2.0)
Ask Toolbar Updater (HKCU Version: 1.2.1.23037)
Assassin's Creed Revelations 1.03 (Version: 1.03)
ASUS GPU Tweak (Version: 2.3.9.2)
Audacity 1.3.12 (Unicode)
Audacity 2.0.2 (Version: 2.0.2)
Auslogics Disk Defrag (Version: 3.6)
AVG 2013 (Version: 13.0.2897)
AVG 2013 (Version: 2013.0.2904)
AXIS Media Control Embedded
AXIS Media Control Embedded Installer (Version: 6.0.65)
Badoo Desktop (Version: 1.6.58.1220)
Basic4android Trial v2.50
Battlefield 2142
Battlefield 3™ (Version: 1.6.0.0)
Battlelog Web Plugins (Version: 2.1.7)
BHV Camgoo Demo
BioShock 2 (Version: 1.0.0005.131)
BioShock 2 (Version: 1.00.0000)
BlackBeatsFM (Version: 1.0)
Blacklight: Retribution
BlueStacks (Version: 0.7.0.722)
Bonjour (Version: 3.0.0.10)
Brink
Call of Duty: Black Ops
Call of Duty: Black Ops - Multiplayer
CameraHelperMsi (Version: 13.50.854.0)
Cheat Engine 6.1
Cisco EAP-FAST Module (Version: 2.2.14)
Cisco LEAP Module (Version: 1.0.19)
Cisco PEAP Module (Version: 1.1.6)
Conduit Engine (Version: )
Connectify (Version: 3.4.0.23678)
Counter-Strike: Condition Zero
Counter-Strike: Source
Counter-Strike: Source (Version: 1.0.0.0)
Counter-Strike: Source Beta
CPUCooL (remove only)
CPUFSB (remove only)
CPUID CPU-Z 1.63.0
Creative ALchemy (Version: 1.41)
Creative Audio-Systemsteuerung (Version: 3.00)
Creative Karaoke Player (Version: 2.11)
Creative Konsole Starter (Version: 2.61)
Creative Media Toolbox 6 (Shared Components) (Version: 2.80.12)
Creative Media Toolbox 6 (Version: 6.00)
Creative MediaSource 5 (Version: 5.00)
Creative Smart Recorder (Version: 2.20)
Creative Systeminformationen
Creative WaveStudio 7 (Version: 7.14)
Crysis WARHEAD(R)
Crysis WARHEAD(R) (Version: 1.0)
Crysis Wars(R)
Crysis Wars(R) (Version: 1.0)
Crysis(R) (Version: 1.00.0000)
Crysis® 2 (Version: 1.0.0.0)
Cucusoft YouTube Mate 8.07
D3DX10 (Version: 15.4.2368.0902)
Data Doctor Recovery - SIM Card (Demo) (Version: 4.4.1.2)
Day of Defeat: Source
Deckadance
DH Driver Cleaner Professional Edition (Version: Version 1.5)
DHTML Editing Component (Version: 6.02.0001)
DirectWave
DivX-Setup (Version: 1.0.2.22)
DX10
EA Download Manager (Version: 4.0.0.462)
Edison
Eigenschaften von Creative Sound Blaster (Version: 1.02)
Elf 1.13 Toolbar (Version: 6.3.0.26)
Epson USB Display (Version: 1.51.000)
erLT (Version: 1.20.138.34)
ESN Sonar (Version: 0.70.4)
F.lux
Facebook Messenger 2.1.4814.0 (Version: 2.1.4814.0)
Facebook Video Calling 1.2.0.287 (Version: 1.2.287)
Far Cry 2 (Version: 1.03.00)
Firebird SQL Server - MAGIX Edition (Version: 2.1.27.0)
FlatOut2 (Version: 1.00.0000)
Fraps (remove only)
Free Download Manager 3.0
Free Studio version 5.0.5
Futuremark SystemInfo (Version: 4.15.0)
GameSpy Comrade (Version: 1.5.0.156)
GEAR 32bit Driver Installer (Version: 2.005.1)
Geeks3D.com FurMark 1.10.1
GIMP 2.6.11 (Version: 2.6.11)
Google Chrome (HKCU Version: 25.0.1364.68)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.5.4209.2358)
Google Update Helper (Version: 1.3.21.145)
Grand Theft Auto IV
Grand Theft Auto IV (Version: 1.0.0011.131)
Grand Theft Auto IV (Version: 1.0.0013.131)
Grand Theft Auto IV (Version: 1.00.0000)
HAL9000 1.7
Half-Life 2: Deathmatch
Half-Life 2: Lost Coast
Handy Recovery 5.5 (Version: 5.5)
Hauppauge WinTV 7 (Version: v7.0.28314)
Hauppauge WinTV Infrared Remote (Version: 2.68.28280)
Hauppauge WinTV IR Blaster (Version: 7.4.28190)
Hercules DJ Products Series drivers (Version: 4.HDJS.2010)
HomeMedia (Version: 2.0.3)
HUAWEI DataCard Driver 4.22.19.00 (Version: 4.22.19.00)
IL Autogun
IL Gross Beat
IL Juice Pack
IL Vocodex
ImgBurn (Version: 2.5.7.0)
Internet Download Manager
Internet-TV für Windows Media Center (Version: 4.2.2.0)
IsoBuster 2.8.5 (Version: 2.8.5)
Java Auto Updater (Version: 2.0.2.1)
Java(TM) 6 Update 33 (Version: 6.0.330)
JNLP
Join Air (Version: 1.0.0.1)
Juiced2_HIN (Version: 1.00.0000)
Kies Air Discovery Service
LAME v3.99.3 (for Windows)
Left 4 Dead 2
Linkury Smartbar (Version: 1.24.22.10764)
Linkury Smartbar Engine (HKCU Version: 1.24.22.10764)
Logitech Vid HD (Version: 7.2 (7240))
Logitech Webcam Software (Version: 2.0)
LWS Facebook (Version: 13.50.854.0)
LWS Gallery (Version: 13.50.854.0)
LWS Help_main (Version: 13.50.862.0)
LWS Launcher (Version: 13.50.859.0)
LWS Motion Detection (Version: 13.30.1395.0)
LWS Pictures And Video (Version: 13.50.861.0)
LWS Twitter (Version: 13.30.1346.0)
LWS Video Mask Maker (Version: 13.30.1379.0)
LWS VideoEffects (Version: 13.30.1379.0)
LWS Webcam Software (Version: 13.31.1038.0)
LWS WLM Plugin (Version: 1.30.1201.0)
LWS YouTube Plugin (Version: 13.31.1038.0)
MagicTune Premium (Version: 4.0.12)
MAGIX Music Maker MX Premium Download-Version (Version: 18.0.0.42)
MAGIX Screenshare (Version: 4.3.6.1987)
MAGIX Speed burnR (MSI) (Version: 7.0.2.6)
Malwarebytes Anti-Malware Version 1.62.0.1300 (Version: 1.62.0.1300)
Mario Forever 5.0
Maximus
Medieval CUE Splitter (Version: 1.0.0)
Messenger Plus! Live (Version: 4.90.0.392)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Antimalware Service DE-DE Language Pack (Version: 2.1.6805.0)
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8107.0)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Games for Windows - LIVE Redistributable (Version: 3.5.92.0)
Microsoft Games for Windows Marketplace (Version: 3.5.50.0)
Microsoft PowerPoint Viewer (Version: 14.0.6029.1000)
Microsoft Security Client (Version: 4.2.0223.1)
Microsoft Security Client DE-DE Language Pack (Version: 2.0.0657.0)
Microsoft Security Essentials (Version: 4.2.223.1)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
MixMeister Fusion Demo 7.4.4
Mobile Broadband Generic Drivers (Version: 2.03.10.002.25)
Mobile Connection Manager (Version: 8.8.7.892)
Morphine
Mozilla Firefox 21.0 (x86 de) (Version: 21.0)
Mozilla Maintenance Service (Version: 21.0)
MSI Star Cam 370i (Version: 100.000.070814)
MSI Star Cam 370i (Version: 5.12.2.25)
MSVC80_x86_v2 (Version: 1.0.3.0)
MSVC90_x86 (Version: 1.0.1.2)
MSVCRT (Version: 15.4.2862.0708)
MSVCRT Redists (Version: 1.0)
MSVCRT110 (Version: 16.4.1108.0727)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MSXML 4.0 SP3 Parser (KB2758694) (Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (Version: 4.30.2100.0)
MyPhoneExplorer (Version: 1.8.2)
Need for Speed™ The Run (Version: 1.1.0.0)
Neffy 1,3,29,0 (Version: 1,3,29,0)
Netlog Uploader (HKCU Version: 1.1.6.0)
Nexon Game Manager
Nokia Connectivity Cable Driver (Version: 7.1.45.0)
Nokia Map Loader (Version: 3.0.28)
Nokia Ovi Player (Version: 2.1.11020)
Nokia Ovi Suite (Version: 3.1.1.90)
Nokia Ovi Suite Software Updater (Version: 02.07.004.45780)
Nokia_Multimedia_Common_Components_2_5 (Version: 2.7.16)
Nur Deinstallierung der CopyTrans Suite möglich. (HKCU Version: 2.27)
NVIDIA HD-Audiotreiber 1.3.24.2 (Version: 1.3.24.2)
NVIDIA Install Application (Version: 2.1002.124.810)
NVIDIA nTune (Version: 1.00.0000)
NVIDIA PhysX (Version: 9.12.1031)
NVIDIA PhysX-Systemsoftware 9.12.1031 (Version: 9.12.1031)
NVIDIA Systemsteuerung 311.06 (Version: 311.06)
Opera 12.10 (Version: 12.10.1652)
Option WWAN Driver 5.0.32.0 Installer  (Version: 3.5.0.1158)
Option WWAN Driver 5.0.32.0 Installer (Version: 3.5.0.1158)
Origin (Version: 8.5.0.4550)
OtsTurntables Free 1.00.047
Ovi Desktop Sync Engine (Version: 1.5.266.0)
OviMPlatform (Version: 2.7.72.0)
Paltalk Messenger  10.2 (Version: 10.2.0)
Pando Media Booster (Version: 2.6.0.8)
PC Connectivity Solution (Version: 11.4.21.0)
Photo Common (Version: 16.4.3508.0205)
PlayReady PC Runtime x86 (Version: 1.3.0)
PowerStrip 3 (remove only)
Project64 1.6 (Version: 1.6)
Proxifier version 2.91 (Version: 2.91)
Proxify Tray Application version 1.0.8.0 (Version: 1.0.8.0)
PunkBuster Services (Version: 0.991)
Realtek High Definition Audio Driver (Version: 6.0.1.6132)
Remote Control Server (Version: 1.7.5.0)
RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition (Version: v2.24 MSI Master Overclocking Arena 2009 edition)
Roadkil's Unstoppable Copier Version 5.2
Saints Row: The Third
Samsung Kies (Version: 2.3.2.12064_9)
Samsung Mobile phone USB driver Drive Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio 3 (Version: 3.0.0.71206)
Samsung PC Studio 3 (Version: 3.2.1.71206)
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.6.0)
Samsung_MonSetup (Version: 1.00.0000)
Scratch Live 2.2.0 (22033) (Version: 2.2.0)
Security Task Manager 1.8f (Version: 1.8f)
simfy (Version: 1.4.9)
Sitecom 11n USB Wireless LAN Driver and Utility (Version: 1.00.0165)
Skype™ 6.5 (Version: 6.5.158)
SocksCap V2
Sony Ericsson PC Companion 2.01.149 (Version: 2.01.149)
Sound Blaster X-Fi Surround 5.1 (Version: 1.0)
Source Multiplayer Dedicated Server
Source SDK
Source SDK Base 2006
Source SDK Base 2007
SpeedFan (remove only)
Spotify (HKCU Version: 0.8.3.222.g317ab79d)
Spybot - Search & Destroy (Version: 1.6.2)
Steam (Version: 1.0.0.0)
STREET FIGHTER IV (Version: 1.00.3013)
StuffIt Expander 2010 (Version: 14.0.0)
System Requirements Lab
System Requirements Lab (Version: 4.3.1.0)
System Requirements Lab CYRI (Version: 5.0.6.0)
Team Fortress 2
TeamSpeak 3 Client (Version: 3.0.8.1)
TeamViewer 7 (Version: 7.0.12541)
Text-To-Speech-Runtime (Version: 1.0.0.0)
The Lord of the Rings Online™ v03.07.01.8015 (Version: 03.07.01.8015)
Titan Quest (Version: 1.00.0000)
TmNationsForever
TuneUp Utilities Language Pack (de-DE) (Version: 10.0.3000.99)
TuneUp Utilities Language Pack (de-DE) (Version: 12.0.3600.73)
Ubisoft Game Launcher (Version: 1.0.0.0)
Unity Web Player (HKCU Version: )
UnLock Root 2.41 (Version: 2.41)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1)
VC80CRTRedist - 8.0.50727.4053 (Version: 1.1.0)
Vegas Pro 11.0 (Version: 11.0.682)
VirtualDJ PRO Full (Version: 7.4)
VLC media player 1.0.5 (Version: 1.0.5)
Vodafone Mobile Connect Lite (Version: 9.4.2.14731)
WarRock
Wecker 2.2 2.2 (Version: 2.2)
Win7codecs (Version: 4.0.0)
Windows 7 Upgrade Advisor (Version: 2.0.5000.0)
Windows 7 USB/DVD Download Tool (Version: 1.0.30)
Windows Driver Package - Google, Inc. AndroidUsbDeviceClass  (12/06/2010 4.0.0000.00000) (Version: 12/06/2010 4.0.0000.00000)
Windows Live Communications Platform (Version: 16.4.3508.0205)
Windows Live Essentials (Version: 16.4.3508.0205)
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)
Windows Live Installer (Version: 16.4.3508.0205)
Windows Live Messenger (Version: 16.4.3508.0205)
Windows Live Photo Common (Version: 16.4.3508.0205)
Windows Live PIMT Platform (Version: 16.4.3508.0205)
Windows Live SOXE (Version: 16.4.3508.0205)
Windows Live SOXE Definitions (Version: 16.4.3508.0205)
Windows Live UX Platform (Version: 16.4.3508.0205)
Windows Live UX Platform Language Pack (Version: 16.4.3508.0205)
Windows Media Center Add-in for Silverlight (Version: 4.7.3.0)
Windows Movie Maker 2.6 (Version: 2.6.4037.0)
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (Version: 08/22/2008 7.0.0.0)
WinPcap 4.1.2 (Version: 4.1.0.2001)
WinRAR 4.01 (32-Bit) (Version: 4.01.0)
WM Recorder (Version: 14.11.2)
WM Recorder (Version: 14.12.2)
World of Tanks
Worms 3D Demo (Version: 0.00.001)
ZTE Drivers v1.2059.0.11 (Version: 1.0.0.25)
ZTE USB Driver (Version: 1.0.1.25_TME)

==================== Restore Points  =========================

Could not list Restore Points.


==================== Scheduled Tasks (whitelisted) =============

Task: {0B5C1D26-A69D-450C-948E-DE1C96459CC4} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-01-27] (Microsoft Corporation)
Task: {0E0F2E2B-F423-47BF-B0CB-1EC174872061} - System32\Tasks\{49090B69-62DD-4246-A8E3-8B14C5713B6A} => C:\Users\kevin\Desktop\RoM Multihack v2.9.09b No File
Task: {108D2882-FD23-45DD-B957-EDA509AC53CF} - System32\Tasks\{596A7DC0-19CB-49CD-A6BF-D31DB867FF1B} => c:\program files\internet explorer\iexplore.exe [2013-05-17] (Microsoft Corporation)
Task: {1499F01C-A5A1-4C55-A794-DADBA5C0B26F} - System32\Tasks\{D3332D73-B353-4D1A-94CC-FDF7B5024FEC} => E:\Autorun.exe No File
Task: {1AB72F55-6452-422C-9B95-C24FA3C9AD77} - System32\Tasks\{72DBD266-83F0-4ECB-8508-9D2ECB8B15CB} => E:\Setup\Setup.exe No File
Task: {2074660B-3B67-4D7F-9DDD-BD73805F5B8C} - System32\Tasks\User_Feed_Synchronization-{1E23D3BD-A4ED-473B-B39E-B889EE424B79} => C:\Windows\system32\msfeedssync.exe [2013-04-05] (Microsoft Corporation)
Task: {22BEBCF0-814D-479F-99EE-06E8CA14B374} - System32\Tasks\{13438248-D0BB-44C1-B598-406136FD136F} => E:\Setup\Setup.exe No File
Task: {23C5AB58-007B-4448-B62B-6021F01EF423} - System32\Tasks\{03DBA127-F5EE-433B-BB95-8D672A48407A} => E:\Setup\Setup.exe No File
Task: {3A048BDA-A5EC-4D4B-947A-9D8A9A3C663E} - System32\Tasks\{F6C3370F-0E6B-4116-92F7-92B5E079B5D4} => C:\Users\kevin\Desktop\VisualBoyAdvance-1.8.0-beta3\VisualBoyAdvance.exe No File
Task: {47FEEF93-CFC8-4212-BA75-51488A506D40} - System32\Tasks\{2336342D-43A3-401A-BA31-86CA34567BAE} => C:\Program Files\Samsung\Samsung PC Studio 3\Launcher.exe [2007-12-14] ()
Task: {4FAC3A2F-296C-4971-A087-07B6DA7B54C8} - System32\Tasks\{4040B74E-A860-43B8-9EAC-F6C814D044EE} => C:\Team17\Worms 3D Demo\Launcher.exe [2003-10-22] (Team17 Software Ltd)
Task: {69A112C1-FA7A-470F-8847-C637C5BD076A} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files\Ask.com\UpdateTask.exe [2012-05-04] ()
Task: {6A688C04-59C3-4482-9658-96317DA0832D} - System32\Tasks\{E6EAE8B2-555D-4322-A3E5-C861178AE616} => c:\program files\internet explorer\iexplore.exe [2013-05-17] (Microsoft Corporation)
Task: {7B808232-EA82-4BF9-8A88-72520DB4D2B1} - System32\Tasks\{DB47CE6D-8A74-4FE1-9ACF-A2ECE1D24D4A} => E:\Setup\Setup.exe No File
Task: {89CEE9C3-A531-4234-850E-EE1BA44E3849} - System32\Tasks\{D086AA7E-1EF9-4A09-B255-B46D5B0E5F60} => C:\Program Files\Skype\\Phone\Skype.exe [2013-06-03] (Skype Technologies S.A.)
Task: {8EFD9DD3-5E52-448A-9CCB-21F95D1687BB} - System32\Tasks\{19F44EF1-7CCB-4AA0-ABA8-96F670841929} => C:\Users\kevin\Desktop\MSI Star Cam 370i.exe No File
Task: {920A7E2E-4E12-492D-BD75-7304D255A9FF} - System32\Tasks\Google Updater and Installer => C:\Users\kevin\AppData\Local\Google\Update\GoogleUpdate.exe No File
Task: {92E3151C-7AEE-43CE-BDED-B1E3B082EDC2} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18] (Sun Microsystems, Inc.)
Task: {953B0E42-868E-422A-8A8F-D61A8CA58B4E} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2011 => C:\Program Files\TuneUp Utilities 2011\OneClick.exe No File
Task: {9CEEE205-200F-4C78-AEBC-5D8E39542C12} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-07-15] (Google Inc.)
Task: {9DF278D4-1410-4320-9F83-7AFF1FABC250} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {9F821761-16E2-4629-9DA6-5A5BDD2FC58A} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {ABB732A7-F4B0-4138-96DE-4EF840FF489C} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-20] (Microsoft Corporation)
Task: {AD8CAD33-5206-4B1F-BEB1-25C94D51FAE0} - System32\Tasks\{AB272285-B863-4011-AC3A-29C3F13BB709} => C:\Users\kevin\Desktop\RoM Multihack v2.9.09b No File
Task: {B1E63869-308E-4460-8A58-655BDC122F9C} - System32\Tasks\{6D5113FD-ED25-45E7-891C-F8F63734E6A4} => E:\setup.exe No File
Task: {BB1F0186-D189-4A9F-8F17-3367FA60BB45} - System32\Tasks\User_Feed_Synchronization-{FD2DC954-A0C3-46AF-A2F3-C5D5DF290CE2} => C:\Windows\system32\msfeedssync.exe [2013-04-05] (Microsoft Corporation)
Task: {BB3654D2-84CD-45C5-BD25-1980EBA52C9C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-13] (Adobe Systems Incorporated)
Task: {C948E476-8795-4519-8EE4-AD148F524017} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {CC913BB9-F6FF-4EDF-A9AB-966C91FE507C} - System32\Tasks\WPD\SqmUpload_S-1-5-21-3072820278-2867077185-342124202-1007 => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {CFC37238-F214-4E42-B5F0-61EF7D54D07E} - System32\Tasks\{25267A73-5C3A-43E7-BC22-54107A40BE49} => E:\Autorun.exe No File
Task: {D081DD6C-7890-4D11-84D9-92F673D1A04A} - System32\Tasks\{8EE09EBF-9D98-4317-BF21-A826FB29637F} => C:\Users\kevin\Desktop\MSI Star Cam 370i.exe No File
Task: {D3295B8C-54C2-426E-86C9-82BE44BB596F} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001Core => C:\Users\kevin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-25] (Facebook Inc.)
Task: {E5F6BD09-6508-4DD7-BAB9-85CCD594C53A} - System32\Tasks\{BBA781FA-64B3-4A55-A666-471B074D8FB6} => C:\Program Files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe No File
Task: {E8DDDEF4-E76E-4FA0-BD7A-81A202FA359E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-07-15] (Google Inc.)
Task: {EEA8010E-DBC3-476A-A4F0-6BAC0CF814DD} - System32\Tasks\{EA1483EA-A0FA-461D-AB90-2ADDB0902127} => C:\Team17\Worms 3D Demo\Launcher.exe [2003-10-22] (Team17 Software Ltd)
Task: {F01EC86B-84BE-4377-B2DA-8551DA7EF39A} - System32\Tasks\{6F285D02-12FD-44B2-A95E-F809DBAC9021} => C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe [2009-04-20] (Vodafone)
Task: {F56456A5-F589-423F-9035-B8F0F648EB3F} - System32\Tasks\{DE931848-CCE3-4809-941B-FA000A4ECAD5} => C:\Program Files\Samsung\Samsung PC Studio 3\Launcher.exe [2007-12-14] ()
Task: {FD638276-DD67-4E5A-9DEB-7A3AAE78B837} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001UA => C:\Users\kevin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-25] (Facebook Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001Core.job => C:\Users\kevin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001UA.job => C:\Users\kevin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Faulty Device Manager Devices =============

Could not list Devices.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/04/2013 01:30:36 PM) (Source: System Restore) (User: )
Description: Unbekannter Fehler bei der Systemwiederherstellung: (Windows Update). Zusätzliche Informationen: 0x80070057.

Error: (07/04/2013 00:56:19 PM) (Source: Windows Search Service) (User: )
Description: Der Filterhostprozess kann nicht initialisiert werden. Der Vorgang wird abgebrochen.


Details:
        Dieser Vorgang wurde wegen Zeitüberschreitung zurückgegeben.  (HRESULT : 0x800705b4) (0x800705b4)

Error: (07/03/2013 02:53:18 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (07/02/2013 02:23:51 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Remote Control Server.exe, Version: 1.7.5.14, Zeitstempel: 0x51b1cbc7
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18015, Zeitstempel: 0x50b83b16
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0x3274
Startzeit der fehlerhaften Anwendung: 0xRemote Control Server.exe0
Pfad der fehlerhaften Anwendung: Remote Control Server.exe1
Pfad des fehlerhaften Moduls: Remote Control Server.exe2
Berichtskennung: Remote Control Server.exe3

Error: (07/02/2013 02:23:51 PM) (Source: .NET Runtime) (User: )
Description: Anwendung: Remote Control Server.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.Configuration.ConfigurationErrorsException
Stapel:
  bei Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase.DoApplicationModel()
  bei Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase.Run(System.String[])
  bei Remote_Control_Server.My.MyApplication.Main(System.String[])

Error: (07/02/2013 01:25:49 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (07/01/2013 08:50:35 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/30/2013 03:11:01 PM) (Source: MsiInstaller) (User: kevin-PC)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (06/30/2013 03:10:59 PM) (Source: MsiInstaller) (User: kevin-PC)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (06/30/2013 03:10:53 PM) (Source: MsiInstaller) (User: kevin-PC)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)


System errors:
=============
Error: (07/04/2013 06:04:39 PM) (Source: Microsoft Antimalware) (User: )
Description: Beim Anwenden von Aktionen auf Schadsoftware und potenziell unerwünschte Software wurde von %VirTool:Win32/Obfuscator.ACV60 ein schwerwiegender Fehler festgestellt.

Weitere Informationen finden Sie hier:
%VirTool:Win32/Obfuscator.ACV603

        Name: VirTool:Win32/Obfuscator.ACV

        ID: 2147667889

        Schweregrad: %VirTool:Win32/Obfuscator.ACV600

        Kategorie: %VirTool:Win32/Obfuscator.ACV602

        Pfad: 4.2.0223.02

        Ursprung der Erkennung: 4.2.0223.04

        Typ der Erkennung: 4.2.0223.08

        Quelle der Erkennung: %VirTool:Win32/Obfuscator.ACV608

        Benutzer: {E6636397-0ED9-49DC-A63C-192B0A55366C}9

        Prozessname: %VirTool:Win32/Obfuscator.ACV609

        Aktion: {E6636397-0ED9-49DC-A63C-192B0A55366C}1

        Aktionsstatus:  {E6636397-0ED9-49DC-A63C-192B0A55366C}8

        Fehlercode: {E6636397-0ED9-49DC-A63C-192B0A55366C}3

        Fehlerbeschreibung: {E6636397-0ED9-49DC-A63C-192B0A55366C}4

        Signaturversion: 2013-07-04T16:04:14.586Z1

        Modulversion: 2013-07-04T16:04:14.586Z2

Error: (07/04/2013 06:00:32 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1079

Error: (07/04/2013 06:00:28 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1079

Error: (07/04/2013 06:00:28 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1079

Error: (07/04/2013 06:00:28 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1079

Error: (07/04/2013 06:00:28 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1079

Error: (07/04/2013 06:00:28 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1079

Error: (07/04/2013 06:00:28 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1079

Error: (07/04/2013 06:00:28 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1079

Error: (07/04/2013 06:00:26 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1079


Microsoft Office Sessions:
=========================
Error: (07/04/2013 01:30:36 PM) (Source: System Restore)(User: )
Description: Windows Update0x80070057

Error: (07/04/2013 00:56:19 PM) (Source: Windows Search Service)(User: )
Description:
Details:
        Dieser Vorgang wurde wegen Zeitüberschreitung zurückgegeben.  (HRESULT : 0x800705b4) (0x800705b4)

Error: (07/03/2013 02:53:18 PM) (Source: SideBySide)(User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\asio4all v2\a4apanel64.exe

Error: (07/02/2013 02:23:51 PM) (Source: Application Error)(User: )
Description: Remote Control Server.exe1.7.5.1451b1cbc7KERNELBASE.dll6.1.7601.1801550b83b16e04343520000812f327401ce771c961cd125C:\Program Files\Remote Control Server\Remote Control Server.exeC:\Windows\system32\KERNELBASE.dll40952e67-e312-11e2-af1a-001d60d1a58c

Error: (07/02/2013 02:23:51 PM) (Source: .NET Runtime)(User: )
Description: Anwendung: Remote Control Server.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.Configuration.ConfigurationErrorsException
Stapel:
  bei Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase.DoApplicationModel()
  bei Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase.Run(System.String[])
  bei Remote_Control_Server.My.MyApplication.Main(System.String[])

Error: (07/02/2013 01:25:49 PM) (Source: SideBySide)(User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\asio4all v2\a4apanel64.exe

Error: (07/01/2013 08:50:35 AM) (Source: SideBySide)(User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\asio4all v2\a4apanel64.exe

Error: (06/30/2013 03:11:01 PM) (Source: MsiInstaller)(User: kevin-PC)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (06/30/2013 03:10:59 PM) (Source: MsiInstaller)(User: kevin-PC)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (06/30/2013 03:10:53 PM) (Source: MsiInstaller)(User: kevin-PC)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)


==================== Memory info ===========================

Percentage of memory in use: 57%
Total physical RAM: 3071.29 MB
Available physical RAM: 1316.61 MB
Total Pagefile: 6140.87 MB
Available Pagefile: 4056.49 MB
Total Virtual: 2047.88 MB
Available Virtual: 1893.79 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:5.91 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: D61A319B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Aneri 04.07.2013 20:17
Hi,

du hast ne richtige Malware Sammlung auf dem System. :)

Mit laufendem TeaTimer von Spybot Search&Destroy lässt sich keine Reinigung durchführen, da er alle gelöschten Einträge wiederherstellt. Der Teatimer muss also während der Reinigungsarbeiten abgestellt werden (lasse den Teatimer so lange ausgeschaltet, bis wir mit der Reinigung fertig sind):
Starte Spybot S&D => stelle im Menü "Modus" den "Erweiterten Modus" ein => klicke dann links unten auf "Werkzeuge" => klicke auf "Resident" => das Häkchen entfernen bei Resident "TeaTimer" (Schutz aller Systemeinstellungen) => Spybot Search&Destroy schließen => Rechner neu starten. Bebilderte Anleitung.



Lesestoff:
Rootkit-Warnung
Dein Computer wurde mit einem besonderen Schädling infiziert, der sich vor herkömmlichen Virenscannern und dem Betriebssystem selbst verstecken kann. Zusätzlich hat so ein Schädling meist auch Backdoor-Funktionalität, reißt also ganz bewußt Löcher durch alle Schutzmaßnahmen, damit er weiteren Schadcode nachladen oder die Daten, die er so sammelt, an die "bösen Jungs" weiterleiten kann. Was heißt das jetzt für dich?
  • Entscheide bitte ganz bewußt, ob du mit der Bereinigung fortfahren möchtest. Ein einmal derartig kompromittiertes System kann man niemals mit 100%iger Sicherheit wieder absichern. Auch wenn wir gute Chancen haben, deinen Computer zu bereinigen, kann es dennoch möglich sein, dass uns am Ende nur die Neuinstallation bleibt.
  • Wenn du mit diesem Computer beispielsweise Onlinebanking machst, dann solltest du zumindest dein Passwort von deiner Bank ändern lassen, wenn du ein ansonsten sicheres Verfahren wie beispielsweise "chip-TAN-comfort" nutzt. Hast du noch alte TAN-Bögen auf Papierbasis? Dann ist es höchste Zeit dich bei deiner Bank zu melden und notfalls das Konto temporär sperren zu lassen. Der Sperrnotruf 116 116 von www.sperr-notruf.de kann Tag und Nacht dafür benutzt werden.
  • Hast du ansonsten sensible Daten auf deinem Computer, dann solltest du auch darüber nachdenken, wie du damit umgehst, da sie sich praktisch "jeder" ansehen konnte.
Teile mir also mit, wie du dich entschieden hast.


Schritt 1

Fix mit FRST
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
HKLM\...\Run: [InstalledTime] 4-14-2013 [x]
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox]  ATTENTION! ====> ZeroAccess
HKCU\...\Run: [Iwboavxoip] C:\Users\kevin\AppData\Roaming\Kuosxu\ubent.exe [x]
HKCU\...\Run: [IExplorer Util] C:\Users\kevin\AppData\Roaming\ie_util.exe [x]
HKCU\...\Winlogon: [Shell] explorer.exe,C:\Users\kevin\AppData\Roaming\skype.dat <==== ATTENTION
HKU\Kevo\...\Run: [Iwboavxoip] C:\Users\Kevo\AppData\Roaming\Kuosxu\ubent.exe [x]
HKU\Kevo\...\Run: [Nyciihi] C:\Users\Kevo\AppData\Roaming\Efuhuw\apum.exe [x]
HKU\Kevo\...\Winlogon: [Shell] explorer.exe <==== ATTENTION
Startup: C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk
ShortcutTarget: regmonstd.lnk -> C:\Users\kevin\AppData\Local\Temp\vivvlqripwqvcenacxu.bfg (Microsoft Corporation)
2013-07-02 02:02 - 2013-07-02 02:02 - 00000004 ____A C:\Users\kevin\AppData\Roaming\skype.ini
2013-06-23 09:20 - 2013-06-23 09:21 - 95023320 ___AT C:\ProgramData\i8irl.pad
2013-06-23 09:20 - 2013-06-23 09:20 - 00044544 ____A (Microsoft Corporation) C:\ProgramData\rundll32.exe
2013-06-23 09:20 - 2013-06-23 09:20 - 00000000 ____A C:\ProgramData\as98213.txt
2013-06-20 00:31 - 2013-06-22 01:53 - 95023320 ___AT C:\ProgramData\inqbin.pad
2013-06-20 00:31 - 2013-06-21 23:36 - 00000000 ____A C:\ProgramData\kjhy64.txt
2013-06-20 00:31 - 2013-06-20 00:31 - 00141312 ____A C:\ProgramData\nibqni.dat
2013-06-22 01:53 - 2013-06-20 00:31 - 95023320 ___AT C:\ProgramData\inqbin.pad
2013-06-21 23:36 - 2013-06-20 00:31 - 00000000 ____A C:\ProgramData\kjhy64.txt
2013-06-20 00:31 - 2013-06-20 00:31 - 00141312 ____A C:\ProgramData\nibqni.dat
ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$fd72f31c638f0885e43ce044e4f81431

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$fd72f31c638f0885e43ce044e4f81431

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-3072820278-2867077185-342124202-1007\$fd72f31c638f0885e43ce044e4f81431

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$fd72f31c638f0885e43ce044e4f81431
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Fix Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


Schritt 2

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Schritt 3

Kontrollscan mit FRST
Führe wie zuvor beschrieben einen Scan mit FRST aus. Es wird nur eine FRST.txt erzeugt. Poste mir diese.

kevinanthony 04.07.2013 20:31
gut hab ich gemacht zuerst kam eine Fehlermeldung, die ich blöderweise weggeklickt habe -.-
er hat trotzdem eine fixlog datei erstellt

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 04-07-2013
Ran by kevin at 2013-07-04 21:27:47 Run:1
Running from C:\Users\kevin\Desktop
Boot Mode: Normal

==============================================

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\InstalledTime => Value deleted successfully.
HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => Value was restored successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\Iwboavxoip => Value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\IExplorer Util => Value deleted successfully.
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon => Key deleted successfully.
HKU\Kevo\Software\Microsoft\Windows\CurrentVersion\Run\\Iwboavxoip => Value not found.
HKU\Kevo\Software\Microsoft\Windows\CurrentVersion\Run\\Nyciihi => Value not found.
HKU\Kevo\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value not found.
C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk => Moved successfully.
ShortcutTarget: regmonstd.lnk -> C:\Users\kevin\AppData\Local\Temp\vivvlqripwqvcenacxu.bfg (Microsoft Corporation) not found.
C:\Users\kevin\AppData\Roaming\skype.ini => Moved successfully.
C:\ProgramData\i8irl.pad => Moved successfully.
C:\ProgramData\rundll32.exe => Moved successfully.
ich hab dann nochmal auf fix gedrückt, da kam dann das raus

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 04-07-2013
Ran by kevin at 2013-07-04 21:28:52 Run:2
Running from C:\Users\kevin\Desktop
Boot Mode: Normal

==============================================

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\InstalledTime => Value not found.
HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => Value was restored successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\Iwboavxoip => Value not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\IExplorer Util => Value not found.
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon => Key not found.
HKU\Kevo\Software\Microsoft\Windows\CurrentVersion\Run\\Iwboavxoip => Value not found.
HKU\Kevo\Software\Microsoft\Windows\CurrentVersion\Run\\Nyciihi => Value not found.
HKU\Kevo\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value not found.
C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk not found.
ShortcutTarget: regmonstd.lnk -> C:\Users\kevin\AppData\Local\Temp\vivvlqripwqvcenacxu.bfg (Microsoft Corporation) not found.
"C:\Users\kevin\AppData\Roaming\skype.ini" => File/Directory not found.
"C:\ProgramData\i8irl.pad" => File/Directory not found.
"C:\ProgramData\rundll32.exe" => File/Directory not found.
C:\ProgramData\as98213.txt => Moved successfully.
C:\ProgramData\inqbin.pad => Moved successfully.
C:\ProgramData\kjhy64.txt => Moved successfully.
C:\ProgramData\nibqni.dat => Moved successfully.
"C:\ProgramData\inqbin.pad" => File/Directory not found.
"C:\ProgramData\kjhy64.txt" => File/Directory not found.
"C:\ProgramData\nibqni.dat" => File/Directory not found.
C:\$Recycle.Bin\S-1-5-18\$fd72f31c638f0885e43ce044e4f81431 => Moved successfully.
"C:\$Recycle.Bin\S-1-5-18\$fd72f31c638f0885e43ce044e4f81431" => File/Directory not found.
C:\$Recycle.Bin\S-1-5-21-3072820278-2867077185-342124202-1007\$fd72f31c638f0885e43ce044e4f81431 => Moved successfully.
"C:\$Recycle.Bin\S-1-5-18\$fd72f31c638f0885e43ce044e4f81431" => File/Directory not found.

==== End of Fixlog ====
hoffentlich hab ich nichts falsches gemacht :heulen:

adwcleaner Log :

Code:
# AdwCleaner v2.304 - Datei am 04/07/2013 um 21:33:23 erstellt
# Aktualisiert am 03/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzer : kevin - KEVIN-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\kevin\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Desinfiziert : C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
Datei Gelöscht : C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\searchplugins\Web Search.xml
Datei Gelöscht : C:\Users\Kevo\AppData\Roaming\Mozilla\Firefox\Profiles\scnt2amw.default\searchplugins\Web Search.xml
Datei Gelöscht : C:\Windows\system32\roboot.exe
Ordner Gelöscht : C:\Program Files\Ask.com
Ordner Gelöscht : C:\Program Files\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Program Files\DVDVideoSoftTB
Ordner Gelöscht : C:\ProgramData\Speedbit
Ordner Gelöscht : C:\Users\kevin\AppData\Local\APN
Ordner Gelöscht : C:\Users\kevin\AppData\Local\AVG Secure Search
Ordner Gelöscht : C:\Users\kevin\AppData\Local\ConduitEngine
Ordner Gelöscht : C:\Users\kevin\AppData\Local\Temp\Smartbar
Ordner Gelöscht : C:\Users\kevin\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\kevin\AppData\LocalLow\AVG Secure Search
Ordner Gelöscht : C:\Users\kevin\AppData\LocalLow\BabylonToolbar
Ordner Gelöscht : C:\Users\kevin\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\kevin\AppData\LocalLow\ConduitEngine
Ordner Gelöscht : C:\Users\kevin\AppData\LocalLow\DVDVideoSoftTB
Ordner Gelöscht : C:\Users\kevin\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\kevin\AppData\LocalLow\Smartbar
Ordner Gelöscht : C:\Users\kevin\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Conduit
Ordner Gelöscht : C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\ConduitCommon
Ordner Gelöscht : C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\extensions\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}
Ordner Gelöscht : C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\extensions\toolbar@ask.com
Ordner Gelöscht : C:\Users\Kevo\AppData\Local\AVG Secure Search
Ordner Gelöscht : C:\Users\Kevo\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Kevo\AppData\LocalLow\ConduitEngine
Ordner Gelöscht : C:\Users\Kevo\AppData\LocalLow\DVDVideoSoftTB
Ordner Gelöscht : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\APN
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DVDVideoSoftTB
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\Headlight
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\PIP
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\SmartbarBackup
Schlüssel Gelöscht : HKCU\Software\SmartbarLog
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\SpeedBit
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\Software\APN
Schlüssel Gelöscht : HKLM\Software\AskToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B2E753AA-5E80-4380-B3F4-2E34FDCF9C4B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Conduit.Engine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.BandObjectAttribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.BHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.DockingPanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.IESmartBar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.IESmartBarBandObject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.SmartbarDisplayState
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.SmartbarMenuForm
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0BF91075-F457-4A8B-99EF-140B52D2F22A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{37425600-CB21-49A0-8659-476FBAB0F8E8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\S
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT1320680
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2269050
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2319825
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2431245
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2857573
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Schlüssel Gelöscht : HKLM\Software\DVDVideoSoftTB
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B2E753AA-5E80-4380-B3F4-2E34FDCF9C4B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\120DFADEB50841F408F04D2A278F9509
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2BDF3E992C0908741B7C11F4B4E0F775
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B3BC4CF5ECE1F54BBA174C13A1AB907
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B5BAE2ED018083A4C8DA86D6E3F4B024
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BEABAA33A5E68374DBF197F2A00CD011
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB61AF52AD64B6B45930BE969F316720
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Schlüssel Gelöscht : HKLM\Software\PIP
Schlüssel Gelöscht : HKLM\SOFTWARE\Software
Schlüssel Gelöscht : HKLM\Software\SpeedBit
Schlüssel Gelöscht : HKU\S-1-5-21-3072820278-2867077185-342124202-1007\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKU\S-1-5-21-3072820278-2867077185-342124202-1007\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKU\S-1-5-21-3072820278-2867077185-342124202-1013\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{30F9B915-B755-4826-820B-08FBA6BD249D}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Browser Infrastructure Helper]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16611

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Search Page] = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}&installDate=01/01/1970 --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Search Bar] = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}&installDate=01/01/1970 --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}&installDate=01/01/1970 --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}&installDate=01/01/1970 --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\SearchUrl - Default] = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}&installDate=01/01/1970 --> hxxp://www.google.com
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl - Default] = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e-467b-aa5d-1c2c70bbadc0&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}&installDate=01/01/1970 --> hxxp://www.google.com

-\\ Mozilla Firefox v21.0 (de)

Datei : C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\prefs.js

C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\user.js ... Gelöscht !

Gelöscht : user_pref("CT1320680..clientLogIsEnabled", false);
Gelöscht : user_pref("CT1320680..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Gelöscht : user_pref("CT1320680..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Gelöscht : user_pref("CT1320680.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Gelöscht : user_pref("CT1320680.AppTrackingLastCheckTime", "Sun Jul 31 2011 20:31:40 GMT+0200");
Gelöscht : user_pref("CT1320680.CTID", "ct1320680");
Gelöscht : user_pref("CT1320680.CurrentServerDate", "31-7-2011");
Gelöscht : user_pref("CT1320680.DialogsAlignMode", "LTR");
Gelöscht : user_pref("CT1320680.DialogsGetterLastCheckTime", "Sun Jul 31 2011 20:31:41 GMT+0200");
Gelöscht : user_pref("CT1320680.DownloadReferralCookieData", "");
Gelöscht : user_pref("CT1320680.FirstServerDate", "31-7-2011");
Gelöscht : user_pref("CT1320680.FirstTime", true);
Gelöscht : user_pref("CT1320680.FirstTimeFF3", true);
Gelöscht : user_pref("CT1320680.FixPageNotFoundErrors", true);
Gelöscht : user_pref("CT1320680.GroupingServerCheckInterval", 1440);
Gelöscht : user_pref("CT1320680.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Gelöscht : user_pref("CT1320680.HasUserGlobalKeys", true);
Gelöscht : user_pref("CT1320680.Initialize", true);
Gelöscht : user_pref("CT1320680.InitializeCommonPrefs", true);
Gelöscht : user_pref("CT1320680.InstallationAndCookieDataSentCount", 1);
Gelöscht : user_pref("CT1320680.InstallationId", "default-xtns205102");
Gelöscht : user_pref("CT1320680.InstallationType", "ConduitIntegration");
Gelöscht : user_pref("CT1320680.InstalledDate", "Sun Jul 31 2011 20:31:28 GMT+0200");
Gelöscht : user_pref("CT1320680.IsGrouping", false);
Gelöscht : user_pref("CT1320680.IsInitSetupIni", true);
Gelöscht : user_pref("CT1320680.IsMulticommunity", false);
Gelöscht : user_pref("CT1320680.IsOpenThankYouPage", false);
Gelöscht : user_pref("CT1320680.IsOpenUninstallPage", true);
Gelöscht : user_pref("CT1320680.LanguagePackLastCheckTime", "Sun Jul 31 2011 20:31:37 GMT+0200");
Gelöscht : user_pref("CT1320680.LanguagePackReloadIntervalMM", 1440);
Gelöscht : user_pref("CT1320680.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Gelöscht : user_pref("CT1320680.LastLogin_3.5.0.12", "Sun Jul 31 2011 20:31:27 GMT+0200");
Gelöscht : user_pref("CT1320680.LatestVersion", "3.3.3.2");
Gelöscht : user_pref("CT1320680.Locale", "en-us");
Gelöscht : user_pref("CT1320680.MCDetectTooltipHeight", "83");
Gelöscht : user_pref("CT1320680.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Gelöscht : user_pref("CT1320680.MCDetectTooltipWidth", "295");
Gelöscht : user_pref("CT1320680.MyStuffEnabledAtInstallation", true);
Gelöscht : user_pref("CT1320680.OriginalFirstVersion", "3.5.0.12");
Gelöscht : user_pref("CT1320680.RadioShrinkedFromSetup", false);
Gelöscht : user_pref("CT1320680.SearchFromAddressBarIsInit", true);
Gelöscht : user_pref("CT1320680.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT132[...]
Gelöscht : user_pref("CT1320680.SearchInNewTabEnabled", true);
Gelöscht : user_pref("CT1320680.SearchInNewTabIntervalMM", 1440);
Gelöscht : user_pref("CT1320680.SearchInNewTabLastCheckTime", "Sun Jul 31 2011 20:31:28 GMT+0200");
Gelöscht : user_pref("CT1320680.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Gelöscht : user_pref("CT1320680.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]
Gelöscht : user_pref("CT1320680.SearchProtectorToolbarDisabled", true);
Gelöscht : user_pref("CT1320680.ServiceMapLastCheckTime", "Sun Jul 31 2011 20:31:24 GMT+0200");
Gelöscht : user_pref("CT1320680.SettingsLastCheckTime", "Sun Jul 31 2011 20:31:24 GMT+0200");
Gelöscht : user_pref("CT1320680.SettingsLastUpdate", "1312121647");
Gelöscht : user_pref("CT1320680.ThirdPartyComponentsInterval", 504);
Gelöscht : user_pref("CT1320680.ThirdPartyComponentsLastCheck", "Sun Jul 31 2011 20:31:24 GMT+0200");
Gelöscht : user_pref("CT1320680.ThirdPartyComponentsLastUpdate", "1246786978");
Gelöscht : user_pref("CT1320680.ToolbarShrinkedFromSetup", false);
Gelöscht : user_pref("CT1320680.TrusteLinkUrl", "hxxp://trust.conduit.com/CT1320680");
Gelöscht : user_pref("CT1320680.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Gelöscht : user_pref("CT1320680.UserID", "UN51690285310283966");
Gelöscht : user_pref("CT1320680.ValidationData_Toolbar", 0);
Gelöscht : user_pref("CT1320680.alertChannelId", "19248");
Gelöscht : user_pref("CT1320680.ct1320680.AppTrackingLastCheckTime", "Sun Jul 31 2011 20:31:41 GMT+0200");
Gelöscht : user_pref("CT1320680.ct1320680.DialogsAlignMode", "LTR");
Gelöscht : user_pref("CT1320680.ct1320680.InvalidateCache", false);
Gelöscht : user_pref("CT1320680.ct1320680.LanguagePackLastCheckTime", "Sun Jul 31 2011 20:31:36 GMT+0200");
Gelöscht : user_pref("CT1320680.ct1320680.Locale", "en-us");
Gelöscht : user_pref("CT1320680.ct1320680.RadioLastCheckTime", "Sun Jul 31 2011 20:31:36 GMT+0200");
Gelöscht : user_pref("CT1320680.ct1320680.RadioLastUpdateIPServer", "3");
Gelöscht : user_pref("CT1320680.ct1320680.RadioLastUpdateServer", "128929877726170000");
Gelöscht : user_pref("CT1320680.ct1320680.SearchInNewTabLastCheckTime", "Sun Jul 31 2011 20:31:30 GMT+0200");
Gelöscht : user_pref("CT1320680.ct1320680.SettingsLastCheckTime", "Sun Jul 31 2011 20:31:28 GMT+0200");
Gelöscht : user_pref("CT1320680.ct1320680.SettingsLastUpdate", "1312121647");
Gelöscht : user_pref("CT1320680.ct1320680.ThirdPartyComponentsLastCheck", "Sun Jul 31 2011 20:31:28 GMT+0200");
Gelöscht : user_pref("CT1320680.ct1320680.ThirdPartyComponentsLastUpdate", "1246786978");
Gelöscht : user_pref("CT1320680.ct1320680.globalFirstTimeInfoLastCheckTime", "Sun Jul 31 2011 20:31:31 GMT+0200[...]
Gelöscht : user_pref("CT1320680.ct1320680.toolbarAppMetaDataLastCheckTime", "Sun Jul 31 2011 20:31:30 GMT+0200"[...]
Gelöscht : user_pref("CT1320680.ct1320680.toolbarContextMenuLastCheckTime", "Sun Jul 31 2011 20:31:36 GMT+0200"[...]
Gelöscht : user_pref("CT1320680.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Gelöscht : user_pref("CT1320680.globalFirstTimeInfoLastCheckTime", "Sun Jul 31 2011 20:31:27 GMT+0200");
Gelöscht : user_pref("CT1320680.homepageProtectorEnableByLogin", true);
Gelöscht : user_pref("CT1320680.initDone", true);
Gelöscht : user_pref("CT1320680.isAppTrackingManagerOn", true);
Gelöscht : user_pref("CT1320680.isFirstRadioInstallation", false);
Gelöscht : user_pref("CT1320680.myStuffEnabled", true);
Gelöscht : user_pref("CT1320680.myStuffPublihserMinWidth", 400);
Gelöscht : user_pref("CT1320680.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Gelöscht : user_pref("CT1320680.myStuffServiceIntervalMM", 1440);
Gelöscht : user_pref("CT1320680.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Gelöscht : user_pref("CT1320680.searchProtectorDialogDelayInSec", 10);
Gelöscht : user_pref("CT1320680.searchProtectorEnableByLogin", true);
Gelöscht : user_pref("CT1320680.testingCtid", "");
Gelöscht : user_pref("CT1320680.toolbarAppMetaDataLastCheckTime", "Sun Jul 31 2011 20:31:26 GMT+0200");
Gelöscht : user_pref("CT1320680.toolbarContextMenuLastCheckTime", "Sun Jul 31 2011 20:31:34 GMT+0200");
Gelöscht : user_pref("CT1320680.usagesFlag", 1);
Gelöscht : user_pref("CT2269050.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Gelöscht : user_pref("CT2269050.CTID", "CT2269050");
Gelöscht : user_pref("CT2269050.CurrentServerDate", "1-11-2010");
Gelöscht : user_pref("CT2269050.DialogsAlignMode", "LTR");
Gelöscht : user_pref("CT2269050.DownloadReferralCookieData", "");
Gelöscht : user_pref("CT2269050.EMailNotifierPollDate", "Mon Nov 01 2010 00:52:46 GMT+0100");
Gelöscht : user_pref("CT2269050.FirstServerDate", "31-10-2010");
Gelöscht : user_pref("CT2269050.FirstTime", true);
Gelöscht : user_pref("CT2269050.FirstTimeFF3", true);
Gelöscht : user_pref("CT2269050.FirstTimeSettingsDone", true);
Gelöscht : user_pref("CT2269050.FixPageNotFoundErrors", true);
Gelöscht : user_pref("CT2269050.GroupingServerCheckInterval", 1440);
Gelöscht : user_pref("CT2269050.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Gelöscht : user_pref("CT2269050.Initialize", true);
Gelöscht : user_pref("CT2269050.InitializeCommonPrefs", true);
Gelöscht : user_pref("CT2269050.InstallationAndCookieDataSentCount", 3);
Gelöscht : user_pref("CT2269050.InstallationType", "UnknownIntegration");
Gelöscht : user_pref("CT2269050.InstalledDate", "Sun Oct 31 2010 20:14:12 GMT+0100");
Gelöscht : user_pref("CT2269050.InvalidateCache", false);
Gelöscht : user_pref("CT2269050.IsGrouping", false);
Gelöscht : user_pref("CT2269050.IsMulticommunity", false);
Gelöscht : user_pref("CT2269050.IsOpenThankYouPage", false);
Gelöscht : user_pref("CT2269050.IsOpenUninstallPage", false);
Gelöscht : user_pref("CT2269050.LanguagePackLastCheckTime", "Sun Oct 31 2010 20:14:18 GMT+0100");
Gelöscht : user_pref("CT2269050.LanguagePackReloadIntervalMM", 1440);
Gelöscht : user_pref("CT2269050.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Gelöscht : user_pref("CT2269050.LastLogin_2.7.2.0", "Mon Nov 01 2010 00:53:05 GMT+0100");
Gelöscht : user_pref("CT2269050.LatestVersion", "2.7.2.0");
Gelöscht : user_pref("CT2269050.Locale", "en");
Gelöscht : user_pref("CT2269050.LoginCache", 4);
Gelöscht : user_pref("CT2269050.MCDetectTooltipHeight", "83");
Gelöscht : user_pref("CT2269050.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Gelöscht : user_pref("CT2269050.MCDetectTooltipWidth", "295");
Gelöscht : user_pref("CT2269050.RadioIsPodcast", false);
Gelöscht : user_pref("CT2269050.RadioLastCheckTime", "Sun Oct 31 2010 20:14:14 GMT+0100");
Gelöscht : user_pref("CT2269050.RadioLastUpdateIPServer", "3");
Gelöscht : user_pref("CT2269050.RadioLastUpdateServer", "129132338014870000");
Gelöscht : user_pref("CT2269050.RadioMediaID", "12473383");
Gelöscht : user_pref("CT2269050.RadioMediaType", "Media Player");
Gelöscht : user_pref("CT2269050.RadioMenuSelectedID", "EBRadioMenu_CT226905012473383");
Gelöscht : user_pref("CT2269050.RadioStationName", "Hotmix%20108");
Gelöscht : user_pref("CT2269050.RadioStationURL", "hxxp://67.202.67.18:8082");
Gelöscht : user_pref("CT2269050.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TER[...]
Gelöscht : user_pref("CT2269050.SearchFromAddressBarIsInit", true);
Gelöscht : user_pref("CT2269050.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT226[...]
Gelöscht : user_pref("CT2269050.SearchInNewTabEnabled", true);
Gelöscht : user_pref("CT2269050.SearchInNewTabIntervalMM", 1440);
Gelöscht : user_pref("CT2269050.SearchInNewTabLastCheckTime", "Sun Oct 31 2010 20:14:14 GMT+0100");
Gelöscht : user_pref("CT2269050.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Gelöscht : user_pref("CT2269050.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]
Gelöscht : user_pref("CT2269050.SettingsCheckIntervalMin", 120);
Gelöscht : user_pref("CT2269050.SettingsLastCheckTime", "Mon Nov 01 2010 00:52:45 GMT+0100");
Gelöscht : user_pref("CT2269050.SettingsLastUpdate", "1288425627");
Gelöscht : user_pref("CT2269050.ThirdPartyComponentsInterval", 504);
Gelöscht : user_pref("CT2269050.ThirdPartyComponentsLastCheck", "Sun Oct 31 2010 20:14:10 GMT+0100");
Gelöscht : user_pref("CT2269050.ThirdPartyComponentsLastUpdate", "1246790578");
Gelöscht : user_pref("CT2269050.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=[...]
Gelöscht : user_pref("CT2269050.UserID", "UN65420009540719232");
Gelöscht : user_pref("CT2269050.ValidationData_Toolbar", 0);
Gelöscht : user_pref("CT2269050.WeatherNetwork", "");
Gelöscht : user_pref("CT2269050.WeatherPollDate", "Mon Nov 01 2010 00:52:47 GMT+0100");
Gelöscht : user_pref("CT2269050.WeatherUnit", "C");
Gelöscht : user_pref("CT2269050.alertChannelId", "666138");
Gelöscht : user_pref("CT2269050.clientLogIsEnabled", true);
Gelöscht : user_pref("CT2269050.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]
Gelöscht : user_pref("CT2269050.myStuffEnabled", true);
Gelöscht : user_pref("CT2269050.myStuffPublihserMinWidth", 400);
Gelöscht : user_pref("CT2269050.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Gelöscht : user_pref("CT2269050.myStuffServiceIntervalMM", 1440);
Gelöscht : user_pref("CT2269050.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Gelöscht : user_pref("CT2269050.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]
Gelöscht : user_pref("CT2431245.DialogsAlignMode", "LTR");
Gelöscht : user_pref("CT2431245.IsGrouping", false);
Gelöscht : user_pref("CT2431245.LanguagePackLastCheckTime", "Sun Dec 19 2010 23:10:50 GMT+0100");
Gelöscht : user_pref("CT2431245.Locale", "de-de");
Gelöscht : user_pref("CT2431245.MCDetectTooltipHeight", "83");
Gelöscht : user_pref("CT2431245.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Gelöscht : user_pref("CT2431245.MCDetectTooltipWidth", "295");
Gelöscht : user_pref("CT2431245.SearchInNewTabLastCheckTime", "Sun Dec 19 2010 23:10:50 GMT+0100");
Gelöscht : user_pref("CT2431245.SettingsCheckIntervalMin", 120);
Gelöscht : user_pref("CT2431245.SettingsLastUpdate", "1291812328");
Gelöscht : user_pref("CT2431245.alertChannelId", "825452");
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT1320680", [...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=ct1320680", [...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.5.[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT1320680",[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT1320680&octid=[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=ct1320680&octid=[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/idel.gif", "[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/minimize.gif[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/play.gif", "[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/stop.gif", "[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Tapuz/vol.gif", "\[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en-us", "\"[...]
Gelöscht : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\kevin\\AppData\\Roaming\\Mozilla\\F[...]
Gelöscht : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.5.0.12");
Gelöscht : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://home.speedbit.com/search.aspx?aff[...]
Gelöscht : user_pref("CommunityToolbar.ToolbarsList", "CT2269050,CT1320680");
Gelöscht : user_pref("CommunityToolbar.ToolbarsList2", "CT2269050,CT1320680");
Gelöscht : user_pref("CommunityToolbar.ToolbarsList4", "CT1320680");
Gelöscht : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Sun Oct 31 2010 20:14:15 GMT+0100");
Gelöscht : user_pref("CommunityToolbar.globalUserId", "2ac8a7c6-2778-48b3-81bc-6ac83e1d7d0c");
Gelöscht : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Gelöscht : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Gelöscht : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Sun Jul 31 2011 20:31:2[...]
Gelöscht : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Gelöscht : user_pref("CommunityToolbar.notifications.locale", "en");
Gelöscht : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
Gelöscht : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sun Jul 31 2011 20:31:23 GMT+0200");
Gelöscht : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1305622559");
Gelöscht : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Gelöscht : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Gelöscht : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Gelöscht : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Gelöscht : user_pref("CommunityToolbar.notifications.userId", "784f731d-44ab-40c6-b1cc-0befeb0a8db1");
Gelöscht : user_pref("browser.babylon.HPOnNewTab", "1");
Gelöscht : user_pref("browser.newtab.url", "hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf2[...]
Gelöscht : user_pref("browser.search.defaulturl", "hxxp://search.babylon.com/web/{searchTerms}?babsrc=browserse[...]
Gelöscht : user_pref("browser.search.order.1", "Search the web (Babylon)");
Gelöscht : user_pref("browser.search.selectedEngine", "Web Search");
Gelöscht : user_pref("browser.startup.homepage", "hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=[...]
Gelöscht : user_pref("extensions.BabylonToolbar.cntry", "DE");
Gelöscht : user_pref("extensions.BabylonToolbar.firstRun", false);
Gelöscht : user_pref("extensions.BabylonToolbar.hdrMd5", "D2453FDEE64F8574FC06D09A7FBA0F61");
Gelöscht : user_pref("extensions.BabylonToolbar.lastActv", "19");
Gelöscht : user_pref("extensions.BabylonToolbar.lastDP", 19);
Gelöscht : user_pref("extensions.helperbar.SmartbarDisabled", false);
Gelöscht : user_pref("extensions.helperbar.SmartbarStateMinimaized", false);
Gelöscht : user_pref("extensions.toolbar@ask.com.install-event-fired", true);
Gelöscht : user_pref("keyword.URL", "hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e[...]
Gelöscht : user_pref("speedbit.dap_installed", true);

Datei : C:\Users\Kevo\AppData\Roaming\Mozilla\Firefox\Profiles\scnt2amw.default\prefs.js

C:\Users\Kevo\AppData\Roaming\Mozilla\Firefox\Profiles\scnt2amw.default\user.js ... Gelöscht !

Gelöscht : user_pref("browser.startup.homepage", "hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=[...]
Gelöscht : user_pref("browser.search.selectedEngine", "Web Search");
Gelöscht : user_pref("keyword.URL", "hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf226-1a4e[...]
Gelöscht : user_pref("browser.newtab.url", "hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=88cdf2[...]

-\\ Opera v12.10.1652.0

Datei : C:\Users\kevin\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] Die Datei ist sauber.

Datei : C:\Users\Kevo\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [40080 octets] - [04/07/2013 17:15:36]
AdwCleaner[S1].txt - [39688 octets] - [04/07/2013 21:33:23]

########## EOF - C:\AdwCleaner[S1].txt - [39749 octets] ##########
kontroll scan :

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 04-07-2013
Ran by kevin (administrator) on 04-07-2013 21:52:50
Running from C:\Users\kevin\Desktop
Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Could not list processes ===============

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKCU\...\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot [3491264 2012-06-10] (Tonec Inc.)
HKCU\...\Run: [GPU Tweak Main] C:\Program Files\ASUS\GPU Tweak\GPUTweak.exe [3268608 2013-05-16] (ASUS)
HKCU\...\Run: [Remote Control Server] C:\Program Files\Remote Control Server\Remote Control Server.exe [2221056 2013-06-07] (Steppschuh)
HKCU\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2012-07-15] (Google Inc.)
HKCU\...\Run: [ProxifyTrayApp] C:\Program Files\Proxify Tray Application\Proxify Tray Application.exe [2689536 2013-02-27] (UpsideOut, Inc.)
HKCU\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [19604072 2013-06-03] (Skype Technologies S.A.)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
MountPoints2: {032d63d6-4b98-11e1-bc14-806e6f6e6963} - D:\Autorun.exe
HKU\Kevo\...\Run: [Iwboavxoip] C:\Users\Kevo\AppData\Roaming\Kuosxu\ubent.exe [x]
HKU\Kevo\...\Run: [Remote Control Server] C:\Program Files\Remote Control Server\Remote Control Server.exe [ 2013-06-07] (Steppschuh)
HKU\Kevo\...\Run: [GPU Tweak Main] C:\Program Files\ASUS\GPU Tweak\GPUTweak.exe [ 2013-05-16] (ASUS)
HKU\Kevo\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [ 2013-06-03] (Skype Technologies S.A.)
HKU\Kevo\...\Run: [Nyciihi] C:\Users\Kevo\AppData\Roaming\Efuhuw\apum.exe [x]
HKU\Kevo\...\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot [ 2012-06-10] (Tonec Inc.)
HKU\Kevo\...\Policies\system: [LogonHoursAction] 2
HKU\Kevo\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Kevo\...\Winlogon: [Shell] explorer.exe <==== ATTENTION
Startup: C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
ShortcutTarget: Facebook Messenger.lnk -> C:\Users\kevin\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe (Facebook)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
BHO: IDM integration (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -No Name - {B80F591E-FE9A-46CF-A13E-180377240586} -  No File
Toolbar: HKCU -No Name - {F92A9FE4-2850-4198-B9D5-279880E49B16} -  No File
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/121022/CTPID.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog5 05 %SystemRoot%\system32\PrxerNsp.dll [61440] (Initex Software)
Winsock: Catalog5 06 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)

Hosts: Hosts file not detected in the default directory
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default
FF NetworkProxy: "backup.ftp", "securewebproxy.org"
FF NetworkProxy: "backup.ftp_port", 1111
FF NetworkProxy: "backup.gopher", "securewebproxy.org"
FF NetworkProxy: "backup.gopher_port", 1111
FF NetworkProxy: "backup.socks", "securewebproxy.org"
FF NetworkProxy: "backup.socks_port", 1111
FF NetworkProxy: "backup.ssl", "securewebproxy.org"
FF NetworkProxy: "backup.ssl_port", 1111
FF NetworkProxy: "ftp", "securewebproxy.org"
FF NetworkProxy: "ftp_port", 1111
FF NetworkProxy: "gopher", "securewebproxy.org"
FF NetworkProxy: "gopher_port", 1111
FF NetworkProxy: "http", "securewebproxy.org"
FF NetworkProxy: "http_port", 1111
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "securewebproxy.org"
FF NetworkProxy: "socks_port", 1111
FF NetworkProxy: "ssl", "securewebproxy.org"
FF NetworkProxy: "ssl_port", 1111
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @esn.me/esnsonar,version=0.70.4 - C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin: @esn/esnlaunch,version=2.1.7 - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin: @java.com/DTPlugin,version=1.6.0_33 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\kevin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\kevin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: facebook.com/fbDesktopPlugin - C:\Users\kevin\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Elite Proxy Switcher - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\eliteproxyswitcher@my-proxy.com
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{88cdf226-1a4e-467b-aa5d-1c2c70bbadc0}
FF Extension: DownloadHelper - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] C:\Users\kevin\AppData\Roaming\5059
FF Extension: Java String Helper - C:\Users\kevin\AppData\Roaming\5059
FF HKLM\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF HKCU\...\Firefox\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF HKCU\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] C:\Users\kevin\AppData\Roaming\5059
FF Extension: Java String Helper - C:\Users\kevin\AppData\Roaming\5059
FF HKCU\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5

========================== Services (Whitelisted) =================

S4 BstHdAndroidSvc; C:\Program Files\BlueStacks\HD-Service.exe [397704 2012-05-31] (BlueStack Systems, Inc.)
S4 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [385416 2012-05-31] (BlueStack Systems, Inc.)
S4 Connectify; C:\Program Files\Connectify\ConnectifyService.exe [65536 2012-05-02] ()
S4 CPUCooLServer; C:\Program Files\CPUCooL\CooLSrv.exe [743936 2011-12-01] ()
S4 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2010-09-17] (Creative Labs)
S4 Creative Media Toolbox 6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\MT6Licensing.exe [79360 2010-08-02] (Creative Labs)
S4 EMP_UDSA; C:\Program Files\EPSON Projector\Epson USB Display V1.5\EMP_UDSA.exe [98304 2011-01-06] (SEIKO EPSON CORPORATION)
R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG)
S4 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®)
S4 Futuremark SystemInfo Service; C:\Program Files\Futuremark\Futuremark SystemInfo\FMSISvc.exe [137488 2012-12-17] (Futuremark Corporation)
S4 GtDetectSc; C:\Program Files\Option\Option WWAN Driver 5.0.32.0 Installer\GtDetectSc.exe [545792 2009-05-04] (OptionNV)
S4 HauppaugeTVServer; C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe [558592 2010-11-03] (Hauppauge Computer Works)
S4 HerculesDJControlMP3; C:\Program Files\Hercules\Audio\DJ Console Series\drivers\x86\HerculesDJControlMP3.EXE [17408 2010-12-23] ()
S4 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [655944 2012-07-03] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation)
S4 npggsvc; C:\Windows\system32\GameMon.des [3890920 2010-06-17] (INCA Internet Co., Ltd.)
S4 NWHelper; C:\Program Files\Novatel Wireless\Drivers\NWHelper.exe [193824 2009-12-04] (Novatel Wireless Inc.)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2013-04-29] ()
S4 Realtek11nCU; C:\Program Files\SITECOM\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-17] (Realtek)
S4 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S4 Sony Ericsson PCCompanion; C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [150528 2011-02-10] (Avanquest Software)
S4 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [201344 2012-01-10] (Telefónica)
S4 UI Assistant Service; C:\Program Files\Mobile Partner Manager\AssistantServices.exe [241664 2009-03-24] ()
S4 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
S4 VMCService; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [9216 2009-04-20] (Vodafone)
S2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [x]
S4 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x]
S2 vToolbarUpdater15.1.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.1.0\ToolbarUpdater.exe [x]

==================== Drivers (Whitelisted) ====================

R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [34592 2013-05-03] (AVG Technologies)
R2 BstHdDrv; C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [66952 2012-05-31] (BlueStack Systems)
R3 Bulk; C:\Windows\System32\Drivers\HDJBulk.sys [153600 2010-12-23] (© Guillemot R&D, 2010. All rights reserved.)
S1 cnnctfy2; C:\Windows\System32\DRIVERS\cnnctfy2.sys [27248 2012-07-03] (Connectify)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [219352 2009-06-05] (Intel Corporation)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [867344 2012-11-14] (<Turtle Entertainment>)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R3 hcw17bda; C:\Windows\System32\drivers\hcw17bda.sys [54016 2010-01-27] (Hauppauge Computer Works, Inc.)
R3 HDJMidi; C:\Windows\System32\DRIVERS\HDJMidi.sys [192000 2010-12-23] (© Guillemot R&D, 2010. All rights reserved.)
R3 ksaud; C:\Windows\System32\drivers\ksaud.sys [899712 2011-07-06] (Creative Technology Ltd.)
S3 LVPr2Mon; C:\Windows\System32\Drivers\LVPr2Mon.sys [25824 2010-05-07] ()
R1 MagicTune; C:\Windows\system32\drivers\MTiCtwl.sys [14336 2010-04-22] (Samsung Electronics, Inc. )
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [9728 2009-02-03] (ZTE Incorporated)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22344 2012-07-03] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
R1 MpKslad140494; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F94C38AE-C066-419C-8A78-C2656981C18B}\MpKslad140494.sys [29904 2013-07-04] (Microsoft Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
R1 ntiopnp; C:\Windows\System32\Drivers\ntiopnp.sys [21080 2010-11-11] ()
R1 ntiowp; C:\Windows\System32\Drivers\ntiowp.sys [12352 2006-10-20] ()
S3 NVFLASH; C:\Windows\system32\drivers\nvflash.sys [12864 2012-03-10] ()
S3 NVR0Dev; C:\Windows\nvoclock.sys [6912 2006-10-31] (NVidia Corp.)
S3 pneteth; C:\Windows\System32\DRIVERS\pneteth.sys [13312 2011-07-19] (June Fabrics Technology Inc.)
S3 PRODIGY; C:\Windows\System32\Drivers\PRODIGY.SYS [32377 2006-08-29] (B-phreaks)
R2 PStrip; C:\Windows\system32\DRIVERS\PSTRIP.SYS [27992 2007-07-15] (EnTech Taiwan)
S3 RivaTuner32; C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys [9088 2009-08-22] ()
R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-29] (Almico Software)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 clwvd; system32\DRIVERS\clwvd.sys [x]
S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x32.sys [x]
S3 UCORESYS; \??\C:\Users\Kevo\Desktop\UCORESYS.SYS [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-04 21:45 - 2013-07-04 21:45 - 00282521 ____A C:\Users\kevin\Desktop\gvu.dib
2013-07-04 21:33 - 2013-07-04 21:34 - 00039819 ____A C:\AdwCleaner[S1].txt
2013-07-04 20:46 - 2013-07-04 20:46 - 00000000 ____D C:\Users\kevin\AppData\Local\Avg2013
2013-07-04 18:01 - 2013-07-04 18:01 - 00000000 ____D C:\FRST
2013-07-04 17:59 - 2013-07-04 18:00 - 01373373 ____A (Farbar) C:\Users\kevin\Desktop\FRST.exe
2013-07-04 17:15 - 2013-07-04 17:16 - 00040080 ____A C:\AdwCleaner[R1].txt
2013-07-04 17:13 - 2013-07-04 17:13 - 00650027 ____A C:\Users\kevin\Desktop\adwcleaner.exe
2013-07-04 15:29 - 2013-07-04 15:29 - 00000000 ____A C:\Users\kevin\Downloads\Fall Out Boy Ft[1]. Lil Wayne, Lupe Fiasco, Kanye West, Travis (of Gym Class Heroes), Tyga, Paul Wall, & Skin Head Rob) - This Aint A Scene, It An Arms Race (Rem
2013-07-04 13:02 - 2013-07-04 13:02 - 21703480 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 22.0.exe
2013-07-03 13:36 - 2013-07-03 13:36 - 00014212 ____A C:\Users\kevin\Desktop\hs_err_pid3876.log
2013-06-30 09:26 - 2013-06-30 09:26 - 00000000 ____D C:\Users\kevin\AppData\Local\{B2B348CF-713B-454E-AF1F-88D90571896E}
2013-06-30 09:21 - 2013-01-18 16:21 - 04133664 ____A (NVIDIA Corporation) C:\Windows\System32\nvcpl.dll
2013-06-30 09:21 - 2013-01-18 16:21 - 03005728 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvc.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 02953448 ____A C:\Windows\System32\nvcoproc.bin
2013-06-30 09:21 - 2013-01-18 16:20 - 02557728 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvcr.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 00639776 ____A (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
2013-06-30 09:21 - 2013-01-18 16:20 - 00108832 ____A (NVIDIA Corporation) C:\Windows\System32\nvmctray.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 00062752 ____A (NVIDIA Corporation) C:\Windows\System32\nvshext.dll
2013-06-30 09:20 - 2013-06-30 09:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-06-30 08:57 - 2013-06-30 08:59 - 171934904 ____A (NVIDIA Corporation) C:\Users\kevin\Desktop\314.22-desktop-win8-win7-winvista-32bit-international-whql.exe
2013-06-27 03:11 - 2013-06-27 03:11 - 00000000 ____D C:\Program Files\Proxify Tray Application
2013-06-24 23:54 - 2013-06-24 23:54 - 00001188 ____A C:\Users\kevin\Desktop\iSRO - Verknüpfung.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00001105 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\ProgramData\Mozilla
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-23 08:42 - 2013-06-23 08:42 - 21151576 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 21.0.exe
2013-06-23 08:19 - 2013-06-24 23:54 - 00000000 ____D C:\Program Files\iSRO
2013-06-23 08:01 - 2013-06-23 08:16 - 1783991173 ____A C:\Users\kevin\Downloads\iSRO_286(2).exe
2013-06-22 23:31 - 2013-06-22 23:31 - 00000000 ____D C:\Users\kevin\AppData\Local\{C0DD6DF3-7E5F-495F-BC91-ED1CF71F38A8}
2013-06-22 03:07 - 2013-06-22 03:07 - 00000000 ____D C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-21 23:38 - 2013-06-21 23:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{A152DDA7-9317-45C6-8EF5-B86ED556741E}
2013-06-20 00:20 - 2013-06-20 00:20 - 00026760 ____A C:\Users\kevin\Downloads\bitshare_default.xml
2013-06-19 23:10 - 2013-06-19 23:10 - 00000000 ____D C:\Users\kevin\AppData\Local\{11E16F19-44CF-4006-B8C0-0E752F9E9D17}
2013-06-15 16:45 - 2013-06-15 16:46 - 00000000 ____D C:\Users\kevin\AppData\Local\{DCB07B9B-1C60-473E-A594-F2F334CCDEAC}
2013-06-15 01:05 - 2013-06-15 01:05 - 00000000 ____D C:\Users\kevin\AppData\Local\{3CF6A213-4817-42E6-A4CB-3FD56676B4D4}
2013-06-14 15:59 - 2013-06-13 21:14 - 00000000 ____D C:\Users\kevin\Desktop\BEST OF MAY 2013
2013-06-14 10:23 - 2013-06-14 10:23 - 00000000 ____D C:\Users\kevin\AppData\Local\{77A77206-43F3-416C-97A7-0146DF373D92}
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\589457bd5c299aeeab
2013-06-14 03:13 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-14 03:13 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-14 03:04 - 2013-06-14 03:12 - 00000000 ____D C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 03:37 - 2013-06-13 15:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{683C7EE4-369F-486F-9646-3D187EE7302F}
2013-06-13 03:22 - 2013-06-13 03:23 - 00086330 ____A C:\hcwDriverInstall.txt
2013-06-13 03:22 - 2010-01-18 14:01 - 00098384 ____A C:\Windows\System32\Drivers\hcw17isd.1b0
2013-06-13 03:22 - 2009-12-09 13:43 - 00101056 ____A C:\Windows\System32\Drivers\hcw17dvb.1b0
2013-06-13 03:22 - 2009-08-11 14:35 - 00249856 ____A (Siano Mobile Silicon) C:\Windows\System32\HcwSmsCt.dll
2013-06-13 03:20 - 2013-06-13 03:20 - 00000000 ____D C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-13 03:19 - 2013-06-13 03:20 - 00173502 ____A C:\hcwclear.txt
2013-06-13 03:19 - 2013-05-17 03:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 03:19 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 03:19 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 09:01 - 2013-06-15 00:59 - 00001979 ____A C:\Users\Public\Desktop\Remote Control Server.lnk
2013-06-12 09:01 - 2013-06-12 09:01 - 00000000 ____D C:\Program Files\Remote Control Server
2013-06-12 08:54 - 2013-06-12 08:54 - 00000000 ____D C:\Users\kevin\Desktop\RNB4U.in - Best of May 2013
2013-06-12 02:24 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 02:24 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 02:24 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 02:23 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 02:23 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 02:23 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 02:23 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 02:23 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 02:23 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-11 22:38 - 2013-06-11 22:38 - 00006890 ____A C:\OFB-EAST109546437.pkg
2013-06-11 22:20 - 2013-06-11 22:21 - 07944668 ____A C:\Users\kevin\Desktop\Baldgroßeronkel Mo Woodpacker.flv
2013-06-11 21:13 - 2013-06-11 21:13 - 00000975 ____A C:\Windows\System32\Drivers\etc\hosts.txt
2013-06-08 04:28 - 2013-06-30 08:41 - 00000000 ____D C:\Users\kevin\AppData\Local\NVIDIA
2013-06-08 04:20 - 2013-02-25 07:27 - 00154400 ____A (NVIDIA Corporation) C:\Windows\System32\Drivers\nvhda32v.sys
2013-06-08 04:20 - 2013-02-25 07:27 - 00028448 ____A (NVIDIA Corporation) C:\Windows\System32\nvhdap32.dll
2013-06-06 20:24 - 2013-06-06 20:25 - 00000000 ____D C:\Users\kevin\AppData\Local\{F7EFB78D-E40A-49F4-A17E-5302E8B17273}

==================== One Month Modified Files and Folders ========

2013-07-04 21:45 - 2013-07-04 21:45 - 00282521 ____A C:\Users\kevin\Desktop\gvu.dib
2013-07-04 21:45 - 2010-12-02 21:26 - 00000000 ____D C:\Users\kevin\AppData\Roaming\Skype
2013-07-04 21:45 - 2009-07-14 06:34 - 00015152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-04 21:45 - 2009-07-14 06:34 - 00015152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-04 21:37 - 2013-04-05 23:30 - 07248904 ____A C:\Windows\setupact.log
2013-07-04 21:37 - 2012-07-15 20:32 - 00001092 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-04 21:37 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-04 21:35 - 2013-02-08 08:48 - 01898000 ____A C:\Windows\WindowsUpdate.log
2013-07-04 21:34 - 2013-07-04 21:33 - 00039819 ____A C:\AdwCleaner[S1].txt
2013-07-04 21:27 - 2013-05-03 02:01 - 00000000 ____D C:\ProgramData\MFAData
2013-07-04 21:16 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-04 21:15 - 2009-07-14 10:56 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-07-04 21:02 - 2012-07-15 20:32 - 00001096 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-04 21:00 - 2011-09-13 20:56 - 00000928 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001UA.job
2013-07-04 20:46 - 2013-07-04 20:46 - 00000000 ____D C:\Users\kevin\AppData\Local\Avg2013
2013-07-04 20:37 - 2012-04-19 20:36 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-04 18:01 - 2013-07-04 18:01 - 00000000 ____D C:\FRST
2013-07-04 18:00 - 2013-07-04 17:59 - 01373373 ____A (Farbar) C:\Users\kevin\Desktop\FRST.exe
2013-07-04 17:16 - 2013-07-04 17:15 - 00040080 ____A C:\AdwCleaner[R1].txt
2013-07-04 17:15 - 2010-06-09 20:58 - 00000000 ____D C:\Users\kevin\AppData\Roaming\DMCache
2013-07-04 17:13 - 2013-07-04 17:13 - 00650027 ____A C:\Users\kevin\Desktop\adwcleaner.exe
2013-07-04 15:29 - 2013-07-04 15:29 - 00000000 ____A C:\Users\kevin\Downloads\Fall Out Boy Ft[1]. Lil Wayne, Lupe Fiasco, Kanye West, Travis (of Gym Class Heroes), Tyga, Paul Wall, & Skin Head Rob) - This Aint A Scene, It An Arms Race (Rem
2013-07-04 13:03 - 2010-06-14 22:25 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-07-04 13:02 - 2013-07-04 13:02 - 21703480 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 22.0.exe
2013-07-04 12:56 - 2011-08-02 01:11 - 00000000 ____D C:\Program Files\Origin
2013-07-04 12:51 - 2012-02-01 22:54 - 00291088 ____A C:\Windows\System32\PnkBstrB.xtr
2013-07-04 12:51 - 2010-12-27 20:52 - 00291088 ____A C:\Windows\System32\PnkBstrB.exe
2013-07-04 12:51 - 2010-12-27 20:52 - 00137992 ____A C:\Windows\System32\Drivers\PnkBstrK.sys
2013-07-04 12:50 - 2010-12-27 20:52 - 00280904 ____A C:\Windows\System32\PnkBstrB.ex0
2013-07-04 03:23 - 2013-02-08 06:49 - 01607382 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-04 00:00 - 2011-09-13 20:56 - 00000906 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001Core.job
2013-07-03 13:36 - 2013-07-03 13:36 - 00014212 ____A C:\Users\kevin\Desktop\hs_err_pid3876.log
2013-07-02 19:56 - 2010-09-18 15:19 - 00000000 ____D C:\Users\kevin\Documents\VirtualDJ
2013-07-02 18:56 - 2010-06-10 22:15 - 00000000 ____D C:\Users\kevin\Desktop\bilder
2013-07-02 18:55 - 2012-12-13 22:03 - 00000000 ____D C:\Users\Kevo\AppData\Roaming\DMCache
2013-07-02 18:53 - 2012-07-05 21:43 - 00000000 ____D C:\Users\Kevo\AppData\Roaming\Skype
2013-07-02 18:51 - 2013-02-08 13:41 - 00000680 _RASH C:\Users\Kevo\ntuser.pol
2013-07-02 18:51 - 2013-02-08 06:51 - 00000000 ____D C:\users\Kevo
2013-06-30 15:08 - 2010-12-02 21:26 - 00000000 ____D C:\ProgramData\Skype
2013-06-30 14:53 - 2010-06-09 18:37 - 00000000 ____D C:\Program Files\Windows Live
2013-06-30 14:51 - 2009-07-14 04:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-06-30 09:26 - 2013-06-30 09:26 - 00000000 ____D C:\Users\kevin\AppData\Local\{B2B348CF-713B-454E-AF1F-88D90571896E}
2013-06-30 09:24 - 2010-06-09 19:07 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-30 09:21 - 2010-06-09 18:34 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-06-30 09:20 - 2013-06-30 09:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-06-30 09:17 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\DriverStore
2013-06-30 08:59 - 2013-06-30 08:57 - 171934904 ____A (NVIDIA Corporation) C:\Users\kevin\Desktop\314.22-desktop-win8-win7-winvista-32bit-international-whql.exe
2013-06-30 08:41 - 2013-06-08 04:28 - 00000000 ____D C:\Users\kevin\AppData\Local\NVIDIA
2013-06-29 15:44 - 2011-03-01 19:17 - 00000000 ____D C:\Program Files\Steam
2013-06-27 03:11 - 2013-06-27 03:11 - 00000000 ____D C:\Program Files\Proxify Tray Application
2013-06-26 14:12 - 2012-08-03 12:02 - 00000000 ____D C:\Users\kevin\Downloads\Video
2013-06-25 01:19 - 2013-04-26 18:27 - 00007270 ____A C:\Windows\PFRO.log
2013-06-25 00:57 - 2013-04-03 20:25 - 00000000 ____D C:\Program Files\Futuremark
2013-06-25 00:57 - 2010-06-09 19:21 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-06-24 23:54 - 2013-06-24 23:54 - 00001188 ____A C:\Users\kevin\Desktop\iSRO - Verknüpfung.lnk
2013-06-24 23:54 - 2013-06-23 08:19 - 00000000 ____D C:\Program Files\iSRO
2013-06-23 08:43 - 2013-06-23 08:43 - 00001105 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\ProgramData\Mozilla
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-23 08:42 - 2013-06-23 08:42 - 21151576 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 21.0.exe
2013-06-23 08:16 - 2013-06-23 08:01 - 1783991173 ____A C:\Users\kevin\Downloads\iSRO_286(2).exe
2013-06-22 23:31 - 2013-06-22 23:31 - 00000000 ____D C:\Users\kevin\AppData\Local\{C0DD6DF3-7E5F-495F-BC91-ED1CF71F38A8}
2013-06-22 08:33 - 2013-02-08 20:20 - 00000680 _RASH C:\Users\kevin\ntuser.pol
2013-06-22 08:33 - 2013-02-08 06:51 - 00000000 ____D C:\users\kevin
2013-06-22 03:07 - 2013-06-22 03:07 - 00000000 ____D C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-22 02:11 - 2012-06-15 02:03 - 00000000 ____D C:\Program Files\BlueStacks
2013-06-22 02:11 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\wfp
2013-06-22 02:08 - 2012-07-15 22:09 - 00000000 ____D C:\Users\kevin\AppData\Roaming\MyPhoneExplorer
2013-06-22 02:08 - 2012-06-15 02:03 - 00000000 ____D C:\Users\kevin\AppData\Local\BlueStacks
2013-06-22 02:08 - 2011-08-02 01:11 - 00000000 ____D C:\ProgramData\Origin
2013-06-22 02:08 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\AppCompat
2013-06-22 02:07 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration
2013-06-22 02:01 - 2010-10-28 06:55 - 00000000 ____D C:\Program Files\gPotato.eu
2013-06-22 00:24 - 2012-06-15 02:03 - 00000000 ____D C:\ProgramData\BlueStacks
2013-06-21 23:38 - 2013-06-21 23:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{A152DDA7-9317-45C6-8EF5-B86ED556741E}
2013-06-20 00:20 - 2013-06-20 00:20 - 00026760 ____A C:\Users\kevin\Downloads\bitshare_default.xml
2013-06-19 23:10 - 2013-06-19 23:10 - 00000000 ____D C:\Users\kevin\AppData\Local\{11E16F19-44CF-4006-B8C0-0E752F9E9D17}
2013-06-15 16:46 - 2013-06-15 16:45 - 00000000 ____D C:\Users\kevin\AppData\Local\{DCB07B9B-1C60-473E-A594-F2F334CCDEAC}
2013-06-15 16:43 - 2013-04-29 10:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins
2013-06-15 01:05 - 2013-06-15 01:05 - 00000000 ____D C:\Users\kevin\AppData\Local\{3CF6A213-4817-42E6-A4CB-3FD56676B4D4}
2013-06-15 00:59 - 2013-06-12 09:01 - 00001979 ____A C:\Users\Public\Desktop\Remote Control Server.lnk
2013-06-15 00:38 - 2012-12-14 00:35 - 00000000 ____D C:\Users\kevin\Desktop\beats
2013-06-15 00:38 - 2010-06-10 22:18 - 00000000 ___RD C:\Users\kevin\Desktop\Programme
2013-06-14 10:23 - 2013-06-14 10:23 - 00000000 ____D C:\Users\kevin\AppData\Local\{77A77206-43F3-416C-97A7-0146DF373D92}
2013-06-14 08:40 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-06-14 07:43 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\589457bd5c299aeeab
2013-06-14 03:12 - 2013-06-14 03:04 - 00000000 ____D C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 21:14 - 2013-06-14 15:59 - 00000000 ____D C:\Users\kevin\Desktop\BEST OF MAY 2013
2013-06-13 18:59 - 2012-05-25 21:51 - 00000000 ___RD C:\Program Files\Skype
2013-06-13 15:38 - 2013-06-13 03:37 - 00000000 ____D C:\Users\kevin\AppData\Local\{683C7EE4-369F-486F-9646-3D187EE7302F}
2013-06-13 03:37 - 2012-04-19 20:36 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-13 03:37 - 2011-12-08 01:13 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-13 03:23 - 2013-06-13 03:22 - 00086330 ____A C:\hcwDriverInstall.txt
2013-06-13 03:20 - 2013-06-13 03:20 - 00000000 ____D C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-13 03:20 - 2013-06-13 03:19 - 00173502 ____A C:\hcwclear.txt
2013-06-13 03:20 - 2013-02-08 14:40 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 03:19 - 2010-06-09 19:21 - 00000000 ____D C:\Windows\System32\Hauppauge
2013-06-13 01:23 - 2013-04-14 22:56 - 00001001 ____A C:\Users\Public\Desktop\ASUS GPU Tweak.lnk
2013-06-13 01:21 - 2011-01-06 04:31 - 00000000 ____D C:\Windows\Downloaded Installations
2013-06-12 09:01 - 2013-06-12 09:01 - 00000000 ____D C:\Program Files\Remote Control Server
2013-06-12 08:57 - 2012-07-02 22:15 - 00000000 ____D C:\Users\kevin\AppData\Local\Downloaded Installations
2013-06-12 08:54 - 2013-06-12 08:54 - 00000000 ____D C:\Users\kevin\Desktop\RNB4U.in - Best of May 2013
2013-06-12 02:02 - 2013-02-08 13:44 - 00113528 ____A C:\Users\Kevo\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-11 22:38 - 2013-06-11 22:38 - 00006890 ____A C:\OFB-EAST109546437.pkg
2013-06-11 22:21 - 2013-06-11 22:20 - 07944668 ____A C:\Users\kevin\Desktop\Baldgroßeronkel Mo Woodpacker.flv
2013-06-11 21:13 - 2013-06-11 21:13 - 00000975 ____A C:\Windows\System32\Drivers\etc\hosts.txt
2013-06-08 13:42 - 2013-06-14 03:13 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 13:40 - 2013-06-14 03:13 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 13:40 - 2013-06-14 03:13 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 13:40 - 2013-06-14 03:13 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 13:40 - 2013-06-14 03:13 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 13:13 - 2013-06-14 03:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 04:40 - 2011-08-02 01:14 - 00000000 ____D C:\Users\kevin\AppData\Roaming\Origin
2013-06-08 04:40 - 2011-08-02 01:14 - 00000000 ____D C:\Users\kevin\AppData\Local\Origin
2013-06-07 08:03 - 2012-10-19 06:02 - 00000000 ____D C:\Users\kevin\Desktop\aktuellere lieder
2013-06-06 20:34 - 2011-08-30 19:46 - 00000000 ____D C:\aktuelle lieder
2013-06-06 20:25 - 2013-06-06 20:24 - 00000000 ____D C:\Users\kevin\AppData\Local\{F7EFB78D-E40A-49F4-A17E-5302E8B17273}

Files to move or delete:
====================
C:\Users\kevin\AppData\Roaming\skype.dat
C:\Users\Kevo\AppData\Roaming\skype.dat
C:\Users\Kevo\AppData\Roaming\skype.ini

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-03 14:49

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---



mir is grad noch etwas aufgefallen, wenn ich auch C:/ gehe befinden sich oben ordner mit komischen buchstaben und zahlen.
beim versuch die ordner zu entfernen sagt er mir "ihn fehlt die berechtigung"

Aneri 05.07.2013 10:03
Hallo

der Sperrbildschirm sollte verschwunden sein, und dein System deutlich schneller laufen, trifft das zu?

Schritt 1

Deinstalliere: SpyBot- Search and Destroy


Schritt 2
Wichtig: Deaktiviere dein Antivirenprogramm und trenne den Rechner nach dem Download vom Netz (WLAN und Netzwerkkabel)

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

kevinanthony 05.07.2013 12:00
hey aneri,

danke für die Antwort, ja du hast recht der sperrbildschirm ist weg und das system läuft DEUTLICH stabiler und programme reagieren auch fixer :abklatsch:

werde die nächsten schritte befolgen

Aneri 05.07.2013 12:34
Na wunderbar,

wir sind aber noch nicht fertig... dein System ist noch infiziert.

Bitte poste das COmbofix Logfile , dann gehts weiter

kevinanthony 05.07.2013 12:43
so hier erstmal das Log

Code:
ComboFix 13-07-04.01 - kevin 05.07.2013  13:10:00.1.4 - x86
ausgeführt von:: c:\users\kevin\Desktop\ComboFix.exe
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\kevin\AppData\Roaming\AcroIEHelpe.txt
c:\users\kevin\AppData\Roaming\eIGgeLFNMH.txt
c:\users\kevin\AppData\Roaming\iL7kMIgIDG.txt
c:\users\kevin\AppData\Roaming\srvblck2.tmp
c:\windows\system32\frapsvid.dll
c:\windows\system32\k_KBDGR.DLL
c:\windows\system32\SET1199.tmp
c:\windows\system32\SET2194.tmp
c:\windows\system32\SET230C.tmp
c:\windows\system32\SET3803.tmp
c:\windows\system32\SET4490.tmp
c:\windows\system32\SET5059.tmp
c:\windows\system32\SET55CA.tmp
c:\windows\system32\SETF5C9.tmp
c:\windows\system32\tmp4463.tmp
c:\windows\system32\tmp454E.tmp
c:\windows\system32\uxt19E7.tmp
c:\windows\UA000096.DLL
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-06-05 bis 2013-07-05  ))))))))))))))))))))))))))))))
.
.
2013-07-05 11:30 . 2013-07-05 11:31        29904        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F94C38AE-C066-419C-8A78-C2656981C18B}\MpKslec89ad34.sys
2013-07-05 11:27 . 2013-07-05 11:32        --------        d-----w-        c:\users\kevin\AppData\Local\temp
2013-07-05 11:27 . 2013-07-05 11:27        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2013-07-04 19:37 . 2013-07-04 19:37        29904        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F94C38AE-C066-419C-8A78-C2656981C18B}\MpKslad140494.sys
2013-07-04 19:37 . 2013-07-05 11:29        60872        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F94C38AE-C066-419C-8A78-C2656981C18B}\offreg.dll
2013-07-04 18:46 . 2013-07-04 18:46        --------        d-----w-        c:\users\kevin\AppData\Local\Avg2013
2013-07-04 16:01 . 2013-07-04 16:01        --------        d-----w-        C:\FRST
2013-07-04 07:34 . 2013-06-12 04:18        7068072        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F94C38AE-C066-419C-8A78-C2656981C18B}\mpengine.dll
2013-07-03 07:35 . 2013-06-12 04:18        7068072        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-06-30 12:52 . 2013-06-30 12:52        22240        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-06-30 07:21 . 2013-01-18 14:20        2953448        ----a-w-        c:\windows\system32\nvcoproc.bin
2013-06-30 07:21 . 2013-01-18 14:20        639776        ----a-w-        c:\windows\system32\nvvsvc.exe
2013-06-30 07:21 . 2013-01-18 14:20        62752        ----a-w-        c:\windows\system32\nvshext.dll
2013-06-30 07:21 . 2013-01-18 14:21        4133664        ----a-w-        c:\windows\system32\nvcpl.dll
2013-06-30 07:21 . 2013-01-18 14:21        3005728        ----a-w-        c:\windows\system32\nvsvc.dll
2013-06-30 07:21 . 2013-01-18 14:20        2557728        ----a-w-        c:\windows\system32\nvsvcr.dll
2013-06-30 07:21 . 2013-01-18 14:20        108832        ----a-w-        c:\windows\system32\nvmctray.dll
2013-06-30 07:20 . 2013-06-30 07:20        --------        d-----w-        c:\programdata\NVIDIA Corporation
2013-06-27 01:11 . 2013-06-27 01:11        --------        d-----w-        c:\program files\Proxify Tray Application
2013-06-23 06:43 . 2013-06-23 06:43        --------        d-----w-        c:\program files\Mozilla Maintenance Service
2013-06-23 06:19 . 2013-06-24 21:54        --------        d-----w-        c:\program files\iSRO
2013-06-22 21:40 . 2013-06-22 21:40        724464        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BB47F6B6-62FF-46DD-91DC-96BB0500400C}\gapaengine.dll
2013-06-22 01:07 . 2013-06-22 01:07        --------        d-----w-        C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-21 22:14 . 2013-06-21 22:26        --------        d-----w-        c:\programdata\BlueStacksSetup
2013-06-14 01:13 . 2013-06-08 11:13        2706432        ----a-w-        c:\windows\system32\mshtml.tlb
2013-06-14 01:13 . 2013-06-08 11:41        218112        ----a-w-        c:\program files\Internet Explorer\sqmapi.dll
2013-06-14 01:13 . 2013-06-14 01:13        --------        d-----w-        C:\589457bd5c299aeeab
2013-06-14 01:04 . 2013-06-14 01:12        --------        d-----w-        C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 01:22 . 2009-08-11 12:35        249856        ----a-w-        c:\windows\system32\HcwSmsCt.dll
2013-06-13 01:20 . 2013-06-13 01:20        --------        d-----w-        C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-12 07:01 . 2013-06-12 07:01        --------        d-----w-        c:\program files\Remote Control Server
2013-06-12 00:24 . 2013-04-25 23:30        1505280        ----a-w-        c:\windows\system32\d3d11.dll
2013-06-12 00:24 . 2013-05-10 03:20        24576        ----a-w-        c:\windows\system32\cryptdlg.dll
2013-06-12 00:24 . 2013-04-26 04:55        492544        ----a-w-        c:\windows\system32\win32spl.dll
2013-06-12 00:23 . 2013-05-13 03:08        903168        ----a-w-        c:\windows\system32\certutil.exe
2013-06-12 00:23 . 2013-05-13 04:45        140288        ----a-w-        c:\windows\system32\cryptsvc.dll
2013-06-12 00:23 . 2013-05-13 04:45        1160192        ----a-w-        c:\windows\system32\crypt32.dll
2013-06-12 00:23 . 2013-05-13 04:45        103936        ----a-w-        c:\windows\system32\cryptnet.dll
2013-06-12 00:23 . 2013-05-13 03:08        43008        ----a-w-        c:\windows\system32\certenc.dll
2013-06-12 00:23 . 2013-04-17 07:02        1230336        ----a-w-        c:\windows\system32\WindowsCodecs.dll
2013-06-12 00:23 . 2013-05-06 05:06        3968872        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2013-06-12 00:23 . 2013-05-06 05:06        3913576        ----a-w-        c:\windows\system32\ntoskrnl.exe
2013-06-12 00:23 . 2013-05-08 05:38        1293672        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2013-06-08 02:28 . 2013-06-30 06:41        --------        d-----w-        c:\users\kevin\AppData\Local\NVIDIA
2013-06-08 02:20 . 2013-02-25 05:27        28448        ----a-w-        c:\windows\system32\nvhdap32.dll
2013-06-08 02:20 . 2013-02-25 05:27        154400        ----a-w-        c:\windows\system32\drivers\nvhda32v.sys
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-05 09:26 . 2010-12-27 18:52        137992        ----a-w-        c:\windows\system32\drivers\PnkBstrK.sys
2013-07-05 09:26 . 2012-02-01 20:54        291088        ----a-w-        c:\windows\system32\PnkBstrB.xtr
2013-07-05 09:26 . 2010-12-27 18:52        291088        ----a-w-        c:\windows\system32\PnkBstrB.exe
2013-07-05 09:25 . 2010-12-27 18:52        280904        ----a-w-        c:\windows\system32\PnkBstrB.ex0
2013-06-13 01:37 . 2012-04-19 18:36        692104        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2013-06-13 01:37 . 2011-12-07 23:13        71048        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2013-06-13 00:10 . 2010-09-17 09:41        893552        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2013-06-13 00:10 . 2010-09-12 10:46        42776        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2013-05-21 23:37 . 2013-03-12 16:11        724464        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-05-03 00:08 . 2013-05-03 00:09        34592        ----a-w-        c:\windows\system32\drivers\avgtpx86.sys
2013-05-02 15:28 . 2010-06-09 15:59        238872        ------w-        c:\windows\system32\MpSigStub.exe
2013-04-29 10:00 . 2010-12-27 18:51        76888        ----a-w-        c:\windows\system32\PnkBstrA.exe
2013-04-28 23:57 . 2010-12-27 18:52        138056        ----a-w-        c:\users\kevin\AppData\Roaming\PnkBstrK.sys
2013-04-13 04:45 . 2013-05-14 21:13        474624        ----a-w-        c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-14 21:13        2176512        ----a-w-        c:\windows\apppatch\AcGenral.dll
2013-04-12 13:45 . 2013-04-24 16:38        1211752        ----a-w-        c:\windows\system32\drivers\ntfs.sys
2013-04-10 05:18 . 2013-05-14 21:13        728424        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys
2013-04-10 05:18 . 2013-05-14 21:13        218984        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys
2013-04-10 03:14 . 2013-05-14 21:14        2347520        ----a-w-        c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension]
@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
2012-02-08 00:49        22376        ----a-w-        c:\program files\Internet Download Manager\IDMShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2012-06-09 3491264]
"GPU Tweak Main"="c:\program files\ASUS\GPU Tweak\GPUTweak.exe" [2013-05-16 3268608]
"Remote Control Server"="c:\program files\Remote Control Server\Remote Control Server.exe" [2013-06-07 2221056]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-07-15 39408]
"ProxifyTrayApp"="c:\program files\Proxify Tray Application\Proxify Tray Application.exe" [2013-02-27 2689536]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-06-03 19604072]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-11 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-11 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-11 150552]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
.
c:\users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Facebook Messenger.lnk - c:\users\kevin\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe [2013-3-7 248240]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"ConsentPromptBehaviorAdmin"= 5 (0x5)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi8"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^AutoStart IR.lnk]
backup=c:\windows\pss\AutoStart IR.lnk.CommonStartup
backupExtension=.CommonStartup
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\AutoStart IR.lnk
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^GammaTray.lnk]
backup=c:\windows\pss\GammaTray.lnk.CommonStartup
backupExtension=.CommonStartup
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\GammaTray.lnk
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinTV Recording Status..lnk]
backup=c:\windows\pss\WinTV Recording Status..lnk.CommonStartup
backupExtension=.CommonStartup
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WinTV Recording Status..lnk
.
[HKLM\~\startupfolder\C:^Users^kevin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Anapod Manager.lnk]
backup=c:\windows\pss\Anapod Manager.lnk.Startup
backupExtension=.Startup
path=c:\users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Anapod Manager.lnk
.
[HKLM\~\startupfolder\C:^Users^kevin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Facebook Messenger.lnk]
backup=c:\windows\pss\Facebook Messenger.lnk.Startup
backupExtension=.Startup
path=c:\users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
.
[HKLM\~\startupfolder\C:^Users^kevin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
backup=c:\windows\pss\LimeWire On Startup.lnk.Startup
backupExtension=.Startup
path=c:\users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk
.
[HKLM\~\startupfolder\C:^Users^kevin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^PdaNet Desktop.lnk]
backup=c:\windows\pss\PdaNet Desktop.lnk.Startup
backupExtension=.Startup
path=c:\users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PdaNet Desktop.lnk
.
[HKLM\~\startupfolder\C:^Users^Kevo^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CPUCooL.lnk]
path=c:\users\Kevo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CPUCooL.lnk
backup=c:\windows\pss\CPUCooL.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^Kevo^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CPUFSB.lnk]
path=c:\users\Kevo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CPUFSB.lnk
backup=c:\windows\pss\CPUFSB.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^Kevo^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^PowerStrip.lnk]
path=c:\users\Kevo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerStrip.lnk
backup=c:\windows\pss\PowerStrip.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstalledTime]
4-3-2013 [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-04-04 21:06        958576        ----a-w-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2012-08-27 20:32        59280        ----a-w-        c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Badoo Desktop]
2012-12-24 17:40        1067232        ----a-w-        c:\programdata\Badoo\Badoo Desktop\1.6.58.1220\Badoo.Desktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Comrade.exe]
2007-06-29 14:03        36864        ----a-w-        c:\program files\GameSpy\Comrade\Comrade.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector U]
2009-04-29 15:44        188416        ----a-w-        c:\program files\Creative\MediaSource5\CTDetctu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative SB Monitoring Utility]
2009-12-16 10:06        98816        ----a-w-        c:\windows\System32\SBAVMon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON_UD_START]
2011-01-06 09:37        341416        ----a-w-        c:\program files\EPSON Projector\Epson USB Display V1.5\EMP_UD.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hercules DJ Series]
2010-09-13 14:52        1283368        ----a-w-        c:\program files\Hercules\Audio\DJ Console Series\HDJSeriesCPL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
2012-06-09 23:47        3491264        ----a-w-        c:\program files\Internet Download Manager\IDMan.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iPScan5x]
2008-09-06 05:28        94208        ----a-w-        c:\windows\iPScan5x.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]
2012-07-02 15:12        21432        ----a-w-        c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPreload]
2012-07-02 15:12        975288        ----a-w-        c:\program files\Samsung\Kies\Kies.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
2012-07-02 15:12        3524536        ----a-w-        c:\program files\Samsung\Kies\KiesTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Vid]
2010-10-29 20:06        5915480        ----a-w-        c:\program files\Logitech\Vid HD\Vid.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LWS]
2011-11-11 12:08        205336        ----a-w-        c:\program files\Logitech\LWS\Webcam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MagicTuneLauncher]
2011-01-04 07:31        51712        ----a-w-        c:\program files\MagicTune Premium\MagicTuneLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2012-07-03 11:46        462920        ----a-w-        c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mobile Connection Manager]
2012-02-07 17:05        4616832        ----a-w-        c:\program files\o2\Mobile Connection Manager\EMMSN.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MobileConnect]
2009-04-20 16:20        2327552        ----a-w-        c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Module Loader]
2007-07-23 13:43        57344        ----a-w-        c:\program files\Creative\Shared Files\Module Loader\DLLML.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMusic FastStart]
2010-10-20 13:32        2192752        ----a-w-        c:\program files\Nokia\Ovi Player\NokiaOviPlayer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
2011-09-01 12:39        966712        ----a-w-        c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
2006-10-31 05:27        81920        ----a-w-        c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Remote Control Server]
2013-06-07 12:02        2221056        ----a-w-        c:\program files\Remote Control Server\Remote Control Server.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2013-06-03 14:39        19604072        ----a-r-        c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Companion]
2011-02-28 14:15        427008        ----a-w-        c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2013-06-06 22:06        1641896        ----a-w-        c:\program files\Steam\Steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2012-07-15 18:32        39408        ----a-w-        c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnpstd3]
2005-12-20 12:39        94208        ----a-w-        c:\windows\tsnpstd3.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UIExec]
2009-03-24 11:59        132608        ----a-w-        c:\program files\Mobile Partner Manager\UIExec.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VolPanel]
2008-11-24 12:01        237693        ----a-w-        c:\program files\Creative\Sound Blaster X-Fi Surround 5.1\Volume Panel\VolPanlu.exe
.
R1 cnnctfy2;Connectify LightWeight Filter;c:\windows\system32\DRIVERS\cnnctfy2.sys [2012-07-03 27248]
R2 EslWireHelper;ESL Wire Helper Service;c:\program files\EslWire\service\WireHelperSvc.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-06-03 162408]
R2 vToolbarUpdater15.1.0;vToolbarUpdater15.1.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\15.1.0\ToolbarUpdater.exe [x]
R3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]
R3 cpuz136;cpuz136;c:\windows\TEMP\cpuz136\cpuz136_x32.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2013-02-06 83864]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2010-06-14 36608]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\DRIVERS\massfilter.sys [2009-04-09 7680]
R3 massfilter_hs;USB Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs.sys [2009-02-03 9728]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 22344]
R3 NVFLASH;NVFLASH;c:\windows\system32\drivers\nvflash.sys [2012-03-10 12864]
R3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [2011-07-19 13312]
R3 PRODIGY;PRODIGY;c:\windows\system32\Drivers\PRODIGY.SYS [2006-08-29 32377]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2013-02-06 181784]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]
R3 UCORESYS;UCORESYS;c:\users\Kevo\Desktop\UCORESYS.SYS [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-13 1343400]
R4 BstHdAndroidSvc;BlueStacks Android Service;c:\program files\BlueStacks\HD-Service.exe BstHdAndroidSvc Android [x]
R4 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;c:\program files\BlueStacks\HD-LogRotatorService.exe [2012-05-31 385416]
R4 Connectify;Connectify;c:\program files\Connectify\ConnectifyService.exe [2012-05-02 65536]
R4 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2010-09-17 79360]
R4 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2010-08-02 79360]
R4 Creative Media Toolbox 6 Licensing Service;Creative Media Toolbox 6 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\MT6Licensing.exe [2010-08-02 79360]
R4 EMP_UDSA;EMP_UDSA;c:\program files\EPSON Projector\Epson USB Display V1.5\EMP_UDSA.exe [2011-01-06 98304]
R4 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
R4 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files\Futuremark\Futuremark SystemInfo\FMSISvc.exe [2012-12-17 137488]
R4 GtDetectSc;GtDetectSc;c:\program files\Option\Option WWAN Driver 5.0.32.0 Installer\GtDetectSc.exe [2009-05-04 545792]
R4 HauppaugeTVServer;HauppaugeTVServer;c:\program files\WinTV\TVServer\HauppaugeTVServer.exe [2010-11-03 558592]
R4 HerculesDJControlMP3;Hercules DJ Control MP3;c:\program files\Hercules\Audio\DJ Console Series\drivers\x86\HerculesDJControlMP3.EXE [2010-12-23 17408]
R4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]
R4 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-06-17 3890920]
R4 NWHelper;Novatel Wireless Device Helper ;c:\program files\Novatel Wireless\Drivers\NWHelper.exe [2009-12-04 193824]
R4 Realtek11nCU;Realtek11nCU;c:\program files\SITECOM\11n USB Wireless LAN Utility\RtlService.exe [2010-04-17 36864]
R4 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-02-10 150528]
R4 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2012-01-19 3027840]
R4 TGCM_ImportWiFiSvc;TGCM_ImportWiFiSvc;c:\program files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [2012-01-10 201344]
R4 UI Assistant Service;UI Assistant Service;c:\program files\Mobile Partner Manager\AssistantServices.exe [2009-03-24 241664]
R4 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2012-01-18 450848]
R4 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2009-04-20 9216]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2013-05-03 34592]
S1 MpKslad140494;MpKslad140494;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F94C38AE-C066-419C-8A78-C2656981C18B}\MpKslad140494.sys [2013-07-04 29904]
S1 MpKslec89ad34;MpKslec89ad34;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F94C38AE-C066-419C-8A78-C2656981C18B}\MpKslec89ad34.sys [2013-07-05 29904]
S1 ntiowp;ntiowp; [x]
S2 BstHdDrv;BlueStacks Hypervisor;c:\program files\BlueStacks\HD-Hypervisor-x86.sys [2012-05-31 66952]
S2 ESLWireAC;ESLWireAC;c:\windows\system32\drivers\ESLWireACD.sys [2012-11-14 867344]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-08-27 1253376]
S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [2012-04-23 96056]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 100328]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35088]
S2 PStrip;PStrip;c:\windows\system32\DRIVERS\PSTRIP.SYS [2007-07-15 27992]
S3 Bulk;HDJBulk;c:\windows\system32\Drivers\HDJBulk.sys [2010-12-23 153600]
S3 hcw17bda;Hauppauge SMS1000-based;c:\windows\system32\drivers\hcw17bda.sys [2010-01-27 54016]
S3 HDJMidi;DJ Control MP3 e2 MIDI;c:\windows\system32\DRIVERS\HDJMidi.sys [2010-12-23 192000]
S3 ksaud;Creative USB Audio Driver;c:\windows\system32\drivers\ksaud.sys [2011-07-06 899712]
S3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 295232]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MPKSLEC89AD34
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2013-07-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-19 01:37]
.
2013-07-04 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001Core.job
- c:\users\kevin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-05 21:55]
.
2013-07-05 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001UA.job
- c:\users\kevin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-05 21:55]
.
2013-07-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-07-15 18:32]
.
2013-07-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-07-15 18:32]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = www.web.de
uSearchAssistant = hxxp://www.google.com
IE: Download aller Links mit IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download mit IDM - c:\program files\Internet Download Manager\IEExt.htm
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{081B3D82-7719-4731-AD43-559AD484DB0B}: DhcpNameServer = 192.168.42.129
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
FF - ProfilePath - c:\users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\
FF - prefs.js: network.proxy.ftp - securewebproxy.org
FF - prefs.js: network.proxy.ftp_port - 1111
FF - prefs.js: network.proxy.gopher - securewebproxy.org
FF - prefs.js: network.proxy.gopher_port - 1111
FF - prefs.js: network.proxy.http - securewebproxy.org
FF - prefs.js: network.proxy.http_port - 1111
FF - prefs.js: network.proxy.socks - securewebproxy.org
FF - prefs.js: network.proxy.socks_port - 1111
FF - prefs.js: network.proxy.ssl - securewebproxy.org
FF - prefs.js: network.proxy.ssl_port - 1111
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2013-06-23 08:43; {88cdf226-1a4e-467b-aa5d-1c2c70bbadc0}; c:\users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\extensions\{88cdf226-1a4e-467b-aa5d-1c2c70bbadc0}
FF - ExtSQL: !HIDDEN! 2013-02-08 06:53; {184AA5E6-741D-464a-820E-94B3ABC2F3B4}; c:\users\kevin\AppData\Roaming\5059
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
WebBrowser-{B80F591E-FE9A-46CF-A13E-180377240586} - (no file)
WebBrowser-{F92A9FE4-2850-4198-B9D5-279880E49B16} - (no file)
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe
MSConfigStartUp-AutoStartNPSAgent - c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe
MSConfigStartUp-CreativeTaskScheduler - c:\program files\Creative\Shared Files\CTSched.exe
MSConfigStartUp-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
MSConfigStartUp-Exetender - c:\program files\Free Ride Games\GPlayer.exe
MSConfigStartUp-Facebook Update - c:\users\Kevo\AppData\Local\Facebook\Update\FacebookUpdate.exe
MSConfigStartUp-Google Update - c:\users\kevin\AppData\Local\Google\Update\GoogleUpdate.exe
MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
MSConfigStartUp-KiesAirMessage - c:\program files\Samsung\Kies\KiesAirMessage.exe
MSConfigStartUp-KiesHelper - c:\program files\Samsung\Kies\KiesHelper.exe
MSConfigStartUp-Logicool Vid - c:\program files\Logicool\Logicool Vid\Vid.exe
MSConfigStartUp-MSC - c:\program files\Microsoft Security Client\mssecex.exe
MSConfigStartUp-MsnMsgr - c:\program files\Windows Live\Messenger\msnmsgr.exe
MSConfigStartUp-PROGRAM - c:\windows\WINDOWS.exe
MSConfigStartUp-ProxyCap - c:\progra~1\PROXYL~1\ProxyCap\pcapui.exe
MSConfigStartUp-snpstd3 - c:\windows\vsnpstd3.exe
MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe
MSConfigStartUp-StereoLinksInstall - c:\program files\NVIDIA Corporation\3D Vision\nvstlink.exe
MSConfigStartUp-Ulead AutoDetector v2 - c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe
AddRemove-Battlelog Web Plugins - c:\program files\Battlelog Web Plugins\uninstall.exe
AddRemove-Elf_1.13 Toolbar - c:\progra~1\Elf_1.13\UNINST~1.EXE
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
AddRemove-Flux - c:\users\kevin\Local Settings\Apps\F.lux\uninstall.exe
AddRemove-Google Chrome - c:\users\kevin\AppData\Local\Google\Chrome\Application\25.0.1364.68\Installer\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3072820278-2867077185-342124202-1001\Software\SecuROM\License information*]
"datasecu"=hex:7b,bf,11,6f,ff,7b,a9,42,c9,0e,25,bd,c6,d8,6f,63,9a,dd,97,df,66,
  fc,6a,49,a8,56,77,e4,61,d2,4d,d3,a7,70,f5,b0,80,d0,c5,c9,51,c4,72,27,dc,25,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(3760)
c:\program files\Internet Download Manager\idmmkb.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\ehome\ehsched.exe
c:\windows\system32\taskhost.exe
c:\windows\ehome\ehRec.exe
c:\windows\system32\conhost.exe
c:\windows\ehome\ehRecvr.exe
c:\windows\eHome\EhTray.exe
c:\program files\Internet Download Manager\IEMonitor.exe
c:\windows\ehome\mcGlidHost.exe
c:\program files\Microsoft Security Client\MpCmdRun.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-07-05  13:40:21 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2013-07-05 11:40
.
Vor Suchlauf: 6.715.838.464 Bytes frei
Nach Suchlauf: 9.268.609.024 Bytes frei
.
- - End Of File - - 9C5DB3E4C7D0E6721AC1295545848F5A
A36C5E4F47E84449FF07ED3517B43A31
eben wo ich den internet explorer geöffnet habe hat er mir ein fenster angezeigt wo ungefär drin stand " sie sind dabei eine sichere verbindung zu verlassen, dinge die sie senden können mit gelesen werden, möchten sie fortfahren? " ne sekunde später genau das gegenteil also das nichts mitgelesen werden kann.. is das normal?!

Aneri 05.07.2013 21:31
Hi :) wird ja besser

Schritt 1

Kontrollscan mit FRST
Führe wie zuvor beschrieben einen Scan mit FRST aus. Es wird nur eine FRST.txt erzeugt. Poste mir diese.

Schritt 2

Downloade dir bitte am gesunden Rechner Farbar's Service Scanner und speichere es auf den Stick. Gehe an den Infizierten Rechner und kopiere die Datei dort auf den Desktop.
  • Starte das Tool mit Doppelklick auf die FSS.exe
  • Gehe sicher, dass folgende Optionen angehakt sind.
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
    • Other Services
  • Klicke auf Scan.
  • Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.
Poste bitte den Inhalt hier.

kevinanthony 06.07.2013 08:10
guten morgen aneri,

Frst scan


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 04-07-2013
Ran by kevin (administrator) on 06-07-2013 09:05:58
Running from C:\Users\kevin\Desktop
Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(MAGIX AG) C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
() C:\Windows\system32\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(Tonec Inc.) C:\Program Files\Internet Download Manager\IDMan.exe
(Tonec Inc.) C:\Program Files\Internet Download Manager\IEMonitor.exe
(UpsideOut, Inc.) C:\Program Files\Proxify Tray Application\Proxify Tray Application.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Facebook) C:\Users\kevin\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe
(Microsoft Corporation) C:\Windows\ehome\ehRecvr.exe
(Microsoft Corporation) C:\Windows\ehome\mcGlidHost.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKCU\...\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot [3491264 2012-06-10] (Tonec Inc.)
HKCU\...\Run: [GPU Tweak Main] C:\Program Files\ASUS\GPU Tweak\GPUTweak.exe [3268608 2013-05-16] (ASUS)
HKCU\...\Run: [Remote Control Server] C:\Program Files\Remote Control Server\Remote Control Server.exe [2221056 2013-06-07] (Steppschuh)
HKCU\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2012-07-15] (Google Inc.)
HKCU\...\Run: [ProxifyTrayApp] C:\Program Files\Proxify Tray Application\Proxify Tray Application.exe [2689536 2013-02-27] (UpsideOut, Inc.)
HKCU\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [19604072 2013-06-03] (Skype Technologies S.A.)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Kevo\...\Run: [Iwboavxoip] C:\Users\Kevo\AppData\Roaming\Kuosxu\ubent.exe [x]
HKU\Kevo\...\Run: [Remote Control Server] C:\Program Files\Remote Control Server\Remote Control Server.exe [ 2013-06-07] (Steppschuh)
HKU\Kevo\...\Run: [GPU Tweak Main] C:\Program Files\ASUS\GPU Tweak\GPUTweak.exe [ 2013-05-16] (ASUS)
HKU\Kevo\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [ 2013-06-03] (Skype Technologies S.A.)
HKU\Kevo\...\Run: [Nyciihi] C:\Users\Kevo\AppData\Roaming\Efuhuw\apum.exe [x]
HKU\Kevo\...\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot [ 2012-06-10] (Tonec Inc.)
HKU\Kevo\...\Policies\system: [LogonHoursAction] 2
HKU\Kevo\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Kevo\...\Winlogon: [Shell] explorer.exe <==== ATTENTION
Startup: C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
ShortcutTarget: Facebook Messenger.lnk -> C:\Users\kevin\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe (Facebook)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO: IDM integration (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/121022/CTPID.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog5 05 %SystemRoot%\system32\PrxerNsp.dll [61440] (Initex Software)
Winsock: Catalog5 06 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default
FF NetworkProxy: "backup.ftp", "securewebproxy.org"
FF NetworkProxy: "backup.ftp_port", 1111
FF NetworkProxy: "backup.gopher", "securewebproxy.org"
FF NetworkProxy: "backup.gopher_port", 1111
FF NetworkProxy: "backup.socks", "securewebproxy.org"
FF NetworkProxy: "backup.socks_port", 1111
FF NetworkProxy: "backup.ssl", "securewebproxy.org"
FF NetworkProxy: "backup.ssl_port", 1111
FF NetworkProxy: "ftp", "securewebproxy.org"
FF NetworkProxy: "ftp_port", 1111
FF NetworkProxy: "gopher", "securewebproxy.org"
FF NetworkProxy: "gopher_port", 1111
FF NetworkProxy: "http", "securewebproxy.org"
FF NetworkProxy: "http_port", 1111
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "securewebproxy.org"
FF NetworkProxy: "socks_port", 1111
FF NetworkProxy: "ssl", "securewebproxy.org"
FF NetworkProxy: "ssl_port", 1111
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @esn.me/esnsonar,version=0.70.4 - C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin: @esn/esnlaunch,version=2.1.7 - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin: @java.com/DTPlugin,version=1.6.0_33 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\kevin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\kevin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: facebook.com/fbDesktopPlugin - C:\Users\kevin\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Elite Proxy Switcher - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\eliteproxyswitcher@my-proxy.com
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{88cdf226-1a4e-467b-aa5d-1c2c70bbadc0}
FF Extension: DownloadHelper - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] C:\Users\kevin\AppData\Roaming\5059
FF Extension: Java String Helper - C:\Users\kevin\AppData\Roaming\5059
FF HKLM\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF HKCU\...\Firefox\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF HKCU\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] C:\Users\kevin\AppData\Roaming\5059
FF Extension: Java String Helper - C:\Users\kevin\AppData\Roaming\5059
FF HKCU\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5

========================== Services (Whitelisted) =================

S4 BstHdAndroidSvc; C:\Program Files\BlueStacks\HD-Service.exe [397704 2012-05-31] (BlueStack Systems, Inc.)
S4 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [385416 2012-05-31] (BlueStack Systems, Inc.)
S4 Connectify; C:\Program Files\Connectify\ConnectifyService.exe [65536 2012-05-02] ()
S4 CPUCooLServer; C:\Program Files\CPUCooL\CooLSrv.exe [743936 2011-12-01] ()
S4 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2010-09-17] (Creative Labs)
S4 Creative Media Toolbox 6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\MT6Licensing.exe [79360 2010-08-02] (Creative Labs)
S4 EMP_UDSA; C:\Program Files\EPSON Projector\Epson USB Display V1.5\EMP_UDSA.exe [98304 2011-01-06] (SEIKO EPSON CORPORATION)
R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG)
S4 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®)
S4 Futuremark SystemInfo Service; C:\Program Files\Futuremark\Futuremark SystemInfo\FMSISvc.exe [137488 2012-12-17] (Futuremark Corporation)
S4 GtDetectSc; C:\Program Files\Option\Option WWAN Driver 5.0.32.0 Installer\GtDetectSc.exe [545792 2009-05-04] (OptionNV)
S4 HauppaugeTVServer; C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe [558592 2010-11-03] (Hauppauge Computer Works)
S4 HerculesDJControlMP3; C:\Program Files\Hercules\Audio\DJ Console Series\drivers\x86\HerculesDJControlMP3.EXE [17408 2010-12-23] ()
S4 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [655944 2012-07-03] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation)
S4 npggsvc; C:\Windows\system32\GameMon.des [3890920 2010-06-17] (INCA Internet Co., Ltd.)
S4 NWHelper; C:\Program Files\Novatel Wireless\Drivers\NWHelper.exe [193824 2009-12-04] (Novatel Wireless Inc.)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2013-04-29] ()
S4 Realtek11nCU; C:\Program Files\SITECOM\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-17] (Realtek)
S4 Sony Ericsson PCCompanion; C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [150528 2011-02-10] (Avanquest Software)
S4 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [201344 2012-01-10] (Telefónica)
S4 UI Assistant Service; C:\Program Files\Mobile Partner Manager\AssistantServices.exe [241664 2009-03-24] ()
S4 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
S4 VMCService; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [9216 2009-04-20] (Vodafone)
S2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [x]
S4 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x]
S2 vToolbarUpdater15.1.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.1.0\ToolbarUpdater.exe [x]

==================== Drivers (Whitelisted) ====================

R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [34592 2013-05-03] (AVG Technologies)
R2 BstHdDrv; C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [66952 2012-05-31] (BlueStack Systems)
R3 Bulk; C:\Windows\System32\Drivers\HDJBulk.sys [153600 2010-12-23] (© Guillemot R&D, 2010. All rights reserved.)
S1 cnnctfy2; C:\Windows\System32\DRIVERS\cnnctfy2.sys [27248 2012-07-03] (Connectify)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [219352 2009-06-05] (Intel Corporation)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [867344 2012-11-14] (<Turtle Entertainment>)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R3 hcw17bda; C:\Windows\System32\drivers\hcw17bda.sys [54016 2010-01-27] (Hauppauge Computer Works, Inc.)
R3 HDJMidi; C:\Windows\System32\DRIVERS\HDJMidi.sys [192000 2010-12-23] (© Guillemot R&D, 2010. All rights reserved.)
R3 ksaud; C:\Windows\System32\drivers\ksaud.sys [899712 2011-07-06] (Creative Technology Ltd.)
S3 LVPr2Mon; C:\Windows\System32\Drivers\LVPr2Mon.sys [25824 2010-05-07] ()
R1 MagicTune; C:\Windows\system32\drivers\MTiCtwl.sys [14336 2010-04-22] (Samsung Electronics, Inc. )
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [9728 2009-02-03] (ZTE Incorporated)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22344 2012-07-03] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
R1 MpKsl997af2e6; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{45A70CCF-06B7-4FB0-B598-88191C0858E9}\MpKsl997af2e6.sys [29904 2013-07-06] (Microsoft Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
R1 ntiopnp; C:\Windows\System32\Drivers\ntiopnp.sys [21080 2010-11-11] ()
R1 ntiowp; C:\Windows\System32\Drivers\ntiowp.sys [12352 2006-10-20] ()
S3 NVFLASH; C:\Windows\system32\drivers\nvflash.sys [12864 2012-03-10] ()
S3 NVR0Dev; C:\Windows\nvoclock.sys [6912 2006-10-31] (NVidia Corp.)
S3 pneteth; C:\Windows\System32\DRIVERS\pneteth.sys [13312 2011-07-19] (June Fabrics Technology Inc.)
S3 PRODIGY; C:\Windows\System32\Drivers\PRODIGY.SYS [32377 2006-08-29] (B-phreaks)
R2 PStrip; C:\Windows\system32\DRIVERS\PSTRIP.SYS [27992 2007-07-15] (EnTech Taiwan)
S3 RivaTuner32; C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys [9088 2009-08-22] ()
R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-29] (Almico Software)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 catchme; \??\C:\Users\kevin\AppData\Local\Temp\catchme.sys [x]
S3 clwvd; system32\DRIVERS\clwvd.sys [x]
S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x32.sys [x]
S3 UCORESYS; \??\C:\Users\Kevo\Desktop\UCORESYS.SYS [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-06 05:16 - 2013-07-06 05:16 - 00014227 ____A C:\Users\kevin\Desktop\hs_err_pid8064.log
2013-07-05 13:40 - 2013-07-05 13:40 - 00035493 ____A C:\ComboFix.txt
2013-07-05 13:06 - 2013-07-05 13:40 - 00000000 ____D C:\Qoobox
2013-07-05 13:06 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-07-05 13:06 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-07-05 13:06 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-07-05 13:05 - 2013-07-05 13:37 - 00000000 ____D C:\Windows\erdnt
2013-07-05 13:04 - 2013-07-05 13:04 - 05085494 ____R (Swearware) C:\Users\kevin\Desktop\ComboFix.exe
2013-07-04 21:45 - 2013-07-04 21:45 - 00282521 ____A C:\Users\kevin\Desktop\gvu.dib
2013-07-04 21:33 - 2013-07-04 21:34 - 00039819 ____A C:\AdwCleaner[S1].txt
2013-07-04 20:46 - 2013-07-04 20:46 - 00000000 ____D C:\Users\kevin\AppData\Local\Avg2013
2013-07-04 18:01 - 2013-07-04 18:01 - 00000000 ____D C:\FRST
2013-07-04 17:59 - 2013-07-04 18:00 - 01373373 ____A (Farbar) C:\Users\kevin\Desktop\FRST.exe
2013-07-04 17:15 - 2013-07-04 17:16 - 00040080 ____A C:\AdwCleaner[R1].txt
2013-07-04 17:13 - 2013-07-04 17:13 - 00650027 ____A C:\Users\kevin\Desktop\adwcleaner.exe
2013-07-04 15:29 - 2013-07-04 15:29 - 00000000 ____A C:\Users\kevin\Downloads\Fall Out Boy Ft[1]. Lil Wayne, Lupe Fiasco, Kanye West, Travis (of Gym Class Heroes), Tyga, Paul Wall, & Skin Head Rob) - This Aint A Scene, It An Arms Race (Rem
2013-07-04 13:02 - 2013-07-04 13:02 - 21703480 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 22.0.exe
2013-07-03 13:36 - 2013-07-03 13:36 - 00014212 ____A C:\Users\kevin\Desktop\hs_err_pid3876.log
2013-06-30 09:26 - 2013-06-30 09:26 - 00000000 ____D C:\Users\kevin\AppData\Local\{B2B348CF-713B-454E-AF1F-88D90571896E}
2013-06-30 09:21 - 2013-01-18 16:21 - 04133664 ____A (NVIDIA Corporation) C:\Windows\System32\nvcpl.dll
2013-06-30 09:21 - 2013-01-18 16:21 - 03005728 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvc.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 02953448 ____A C:\Windows\System32\nvcoproc.bin
2013-06-30 09:21 - 2013-01-18 16:20 - 02557728 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvcr.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 00639776 ____A (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
2013-06-30 09:21 - 2013-01-18 16:20 - 00108832 ____A (NVIDIA Corporation) C:\Windows\System32\nvmctray.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 00062752 ____A (NVIDIA Corporation) C:\Windows\System32\nvshext.dll
2013-06-30 09:20 - 2013-06-30 09:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-06-30 08:57 - 2013-06-30 08:59 - 171934904 ____A (NVIDIA Corporation) C:\Users\kevin\Desktop\314.22-desktop-win8-win7-winvista-32bit-international-whql.exe
2013-06-27 03:11 - 2013-06-27 03:11 - 00000000 ____D C:\Program Files\Proxify Tray Application
2013-06-24 23:54 - 2013-06-24 23:54 - 00001188 ____A C:\Users\kevin\Desktop\iSRO - Verknüpfung.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00001105 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\ProgramData\Mozilla
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-23 08:42 - 2013-06-23 08:42 - 21151576 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 21.0.exe
2013-06-23 08:19 - 2013-06-24 23:54 - 00000000 ____D C:\Program Files\iSRO
2013-06-23 08:01 - 2013-06-23 08:16 - 1783991173 ____A C:\Users\kevin\Downloads\iSRO_286(2).exe
2013-06-22 23:31 - 2013-06-22 23:31 - 00000000 ____D C:\Users\kevin\AppData\Local\{C0DD6DF3-7E5F-495F-BC91-ED1CF71F38A8}
2013-06-22 03:07 - 2013-06-22 03:07 - 00000000 ____D C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-21 23:38 - 2013-06-21 23:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{A152DDA7-9317-45C6-8EF5-B86ED556741E}
2013-06-20 00:20 - 2013-06-20 00:20 - 00026760 ____A C:\Users\kevin\Downloads\bitshare_default.xml
2013-06-19 23:10 - 2013-06-19 23:10 - 00000000 ____D C:\Users\kevin\AppData\Local\{11E16F19-44CF-4006-B8C0-0E752F9E9D17}
2013-06-15 16:45 - 2013-06-15 16:46 - 00000000 ____D C:\Users\kevin\AppData\Local\{DCB07B9B-1C60-473E-A594-F2F334CCDEAC}
2013-06-15 01:05 - 2013-06-15 01:05 - 00000000 ____D C:\Users\kevin\AppData\Local\{3CF6A213-4817-42E6-A4CB-3FD56676B4D4}
2013-06-14 15:59 - 2013-06-13 21:14 - 00000000 ____D C:\Users\kevin\Desktop\BEST OF MAY 2013
2013-06-14 10:23 - 2013-06-14 10:23 - 00000000 ____D C:\Users\kevin\AppData\Local\{77A77206-43F3-416C-97A7-0146DF373D92}
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\589457bd5c299aeeab
2013-06-14 03:13 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-14 03:13 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-14 03:04 - 2013-06-14 03:12 - 00000000 ____D C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 03:37 - 2013-06-13 15:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{683C7EE4-369F-486F-9646-3D187EE7302F}
2013-06-13 03:22 - 2013-06-13 03:23 - 00086330 ____A C:\hcwDriverInstall.txt
2013-06-13 03:22 - 2010-01-18 14:01 - 00098384 ____A C:\Windows\System32\Drivers\hcw17isd.1b0
2013-06-13 03:22 - 2009-12-09 13:43 - 00101056 ____A C:\Windows\System32\Drivers\hcw17dvb.1b0
2013-06-13 03:22 - 2009-08-11 14:35 - 00249856 ____A (Siano Mobile Silicon) C:\Windows\System32\HcwSmsCt.dll
2013-06-13 03:20 - 2013-06-13 03:20 - 00000000 ____D C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-13 03:19 - 2013-06-13 03:20 - 00173502 ____A C:\hcwclear.txt
2013-06-13 03:19 - 2013-05-17 03:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 03:19 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 03:19 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 09:01 - 2013-06-15 00:59 - 00001979 ____A C:\Users\Public\Desktop\Remote Control Server.lnk
2013-06-12 09:01 - 2013-06-12 09:01 - 00000000 ____D C:\Program Files\Remote Control Server
2013-06-12 08:54 - 2013-06-12 08:54 - 00000000 ____D C:\Users\kevin\Desktop\RNB4U.in - Best of May 2013
2013-06-12 02:24 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 02:24 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 02:24 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 02:23 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 02:23 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 02:23 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 02:23 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 02:23 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 02:23 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-11 22:38 - 2013-06-11 22:38 - 00006890 ____A C:\OFB-EAST109546437.pkg
2013-06-11 22:20 - 2013-06-11 22:21 - 07944668 ____A C:\Users\kevin\Desktop\Baldgroßeronkel Mo Woodpacker.flv
2013-06-11 21:13 - 2013-06-11 21:13 - 00000975 ____A C:\Windows\System32\Drivers\etc\hosts.txt
2013-06-08 04:28 - 2013-06-30 08:41 - 00000000 ____D C:\Users\kevin\AppData\Local\NVIDIA
2013-06-08 04:20 - 2013-02-25 07:27 - 00154400 ____A (NVIDIA Corporation) C:\Windows\System32\Drivers\nvhda32v.sys
2013-06-08 04:20 - 2013-02-25 07:27 - 00028448 ____A (NVIDIA Corporation) C:\Windows\System32\nvhdap32.dll
2013-06-06 20:24 - 2013-06-06 20:25 - 00000000 ____D C:\Users\kevin\AppData\Local\{F7EFB78D-E40A-49F4-A17E-5302E8B17273}

==================== One Month Modified Files and Folders ========

2013-07-06 09:07 - 2012-07-15 20:32 - 00001096 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-06 09:05 - 2010-12-02 21:26 - 00000000 ____D C:\Users\kevin\AppData\Roaming\Skype
2013-07-06 09:00 - 2011-09-13 20:56 - 00000928 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001UA.job
2013-07-06 08:37 - 2012-04-19 20:36 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-06 05:45 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-06 05:16 - 2013-07-06 05:16 - 00014227 ____A C:\Users\kevin\Desktop\hs_err_pid8064.log
2013-07-06 05:10 - 2009-07-14 06:34 - 00015152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-06 05:10 - 2009-07-14 06:34 - 00015152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-06 05:07 - 2013-02-08 08:48 - 01111620 ____A C:\Windows\WindowsUpdate.log
2013-07-06 05:02 - 2013-04-05 23:30 - 07504408 ____A C:\Windows\setupact.log
2013-07-06 05:02 - 2012-07-15 20:32 - 00001092 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-06 05:02 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-05 21:44 - 2013-02-08 06:49 - 01607382 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-05 21:19 - 2010-06-09 20:58 - 00000000 ____D C:\Users\kevin\AppData\Roaming\DMCache
2013-07-05 19:23 - 2009-07-14 10:56 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-07-05 13:40 - 2013-07-05 13:40 - 00035493 ____A C:\ComboFix.txt
2013-07-05 13:40 - 2013-07-05 13:06 - 00000000 ____D C:\Qoobox
2013-07-05 13:40 - 2009-07-14 04:37 - 00000000 __RHD C:\users\Default
2013-07-05 13:40 - 2009-07-14 04:37 - 00000000 ___RD C:\users\Public
2013-07-05 13:37 - 2013-07-05 13:05 - 00000000 ____D C:\Windows\erdnt
2013-07-05 13:30 - 2009-07-14 04:04 - 00000215 ____A C:\Windows\system.ini
2013-07-05 13:28 - 2013-04-26 18:27 - 00008276 ____A C:\Windows\PFRO.log
2013-07-05 13:04 - 2013-07-05 13:04 - 05085494 ____R (Swearware) C:\Users\kevin\Desktop\ComboFix.exe
2013-07-05 13:03 - 2012-07-05 14:33 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-07-05 13:03 - 2012-07-05 14:33 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy
2013-07-05 11:26 - 2012-02-01 22:54 - 00291088 ____A C:\Windows\System32\PnkBstrB.xtr
2013-07-05 11:26 - 2010-12-27 20:52 - 00291088 ____A C:\Windows\System32\PnkBstrB.exe
2013-07-05 11:26 - 2010-12-27 20:52 - 00137992 ____A C:\Windows\System32\Drivers\PnkBstrK.sys
2013-07-05 11:25 - 2010-12-27 20:52 - 00280904 ____A C:\Windows\System32\PnkBstrB.ex0
2013-07-05 11:02 - 2011-08-02 01:11 - 00000000 ____D C:\Program Files\Origin
2013-07-05 00:00 - 2011-09-13 20:56 - 00000906 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001Core.job
2013-07-04 21:45 - 2013-07-04 21:45 - 00282521 ____A C:\Users\kevin\Desktop\gvu.dib
2013-07-04 21:34 - 2013-07-04 21:33 - 00039819 ____A C:\AdwCleaner[S1].txt
2013-07-04 21:27 - 2013-05-03 02:01 - 00000000 ____D C:\ProgramData\MFAData
2013-07-04 20:46 - 2013-07-04 20:46 - 00000000 ____D C:\Users\kevin\AppData\Local\Avg2013
2013-07-04 18:01 - 2013-07-04 18:01 - 00000000 ____D C:\FRST
2013-07-04 18:00 - 2013-07-04 17:59 - 01373373 ____A (Farbar) C:\Users\kevin\Desktop\FRST.exe
2013-07-04 17:16 - 2013-07-04 17:15 - 00040080 ____A C:\AdwCleaner[R1].txt
2013-07-04 17:13 - 2013-07-04 17:13 - 00650027 ____A C:\Users\kevin\Desktop\adwcleaner.exe
2013-07-04 15:29 - 2013-07-04 15:29 - 00000000 ____A C:\Users\kevin\Downloads\Fall Out Boy Ft[1]. Lil Wayne, Lupe Fiasco, Kanye West, Travis (of Gym Class Heroes), Tyga, Paul Wall, & Skin Head Rob) - This Aint A Scene, It An Arms Race (Rem
2013-07-04 13:03 - 2010-06-14 22:25 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-07-04 13:02 - 2013-07-04 13:02 - 21703480 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 22.0.exe
2013-07-03 13:36 - 2013-07-03 13:36 - 00014212 ____A C:\Users\kevin\Desktop\hs_err_pid3876.log
2013-07-02 19:56 - 2010-09-18 15:19 - 00000000 ____D C:\Users\kevin\Documents\VirtualDJ
2013-07-02 18:56 - 2010-06-10 22:15 - 00000000 ____D C:\Users\kevin\Desktop\bilder
2013-07-02 18:55 - 2012-12-13 22:03 - 00000000 ____D C:\Users\Kevo\AppData\Roaming\DMCache
2013-07-02 18:53 - 2012-07-05 21:43 - 00000000 ____D C:\Users\Kevo\AppData\Roaming\Skype
2013-07-02 18:51 - 2013-02-08 13:41 - 00000680 _RASH C:\Users\Kevo\ntuser.pol
2013-07-02 18:51 - 2013-02-08 06:51 - 00000000 ____D C:\users\Kevo
2013-06-30 15:08 - 2010-12-02 21:26 - 00000000 ____D C:\ProgramData\Skype
2013-06-30 14:53 - 2010-06-09 18:37 - 00000000 ____D C:\Program Files\Windows Live
2013-06-30 14:51 - 2009-07-14 04:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-06-30 09:26 - 2013-06-30 09:26 - 00000000 ____D C:\Users\kevin\AppData\Local\{B2B348CF-713B-454E-AF1F-88D90571896E}
2013-06-30 09:24 - 2010-06-09 19:07 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-30 09:21 - 2010-06-09 18:34 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-06-30 09:20 - 2013-06-30 09:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-06-30 09:17 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\DriverStore
2013-06-30 08:59 - 2013-06-30 08:57 - 171934904 ____A (NVIDIA Corporation) C:\Users\kevin\Desktop\314.22-desktop-win8-win7-winvista-32bit-international-whql.exe
2013-06-30 08:41 - 2013-06-08 04:28 - 00000000 ____D C:\Users\kevin\AppData\Local\NVIDIA
2013-06-29 15:44 - 2011-03-01 19:17 - 00000000 ____D C:\Program Files\Steam
2013-06-27 03:11 - 2013-06-27 03:11 - 00000000 ____D C:\Program Files\Proxify Tray Application
2013-06-26 14:12 - 2012-08-03 12:02 - 00000000 ____D C:\Users\kevin\Downloads\Video
2013-06-25 00:57 - 2013-04-03 20:25 - 00000000 ____D C:\Program Files\Futuremark
2013-06-25 00:57 - 2010-06-09 19:21 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-06-24 23:54 - 2013-06-24 23:54 - 00001188 ____A C:\Users\kevin\Desktop\iSRO - Verknüpfung.lnk
2013-06-24 23:54 - 2013-06-23 08:19 - 00000000 ____D C:\Program Files\iSRO
2013-06-23 08:43 - 2013-06-23 08:43 - 00001105 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\ProgramData\Mozilla
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-23 08:42 - 2013-06-23 08:42 - 21151576 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 21.0.exe
2013-06-23 08:16 - 2013-06-23 08:01 - 1783991173 ____A C:\Users\kevin\Downloads\iSRO_286(2).exe
2013-06-22 23:31 - 2013-06-22 23:31 - 00000000 ____D C:\Users\kevin\AppData\Local\{C0DD6DF3-7E5F-495F-BC91-ED1CF71F38A8}
2013-06-22 08:33 - 2013-02-08 20:20 - 00000680 _RASH C:\Users\kevin\ntuser.pol
2013-06-22 08:33 - 2013-02-08 06:51 - 00000000 ____D C:\users\kevin
2013-06-22 03:07 - 2013-06-22 03:07 - 00000000 ____D C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-22 02:11 - 2012-06-15 02:03 - 00000000 ____D C:\Program Files\BlueStacks
2013-06-22 02:11 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\wfp
2013-06-22 02:08 - 2012-07-15 22:09 - 00000000 ____D C:\Users\kevin\AppData\Roaming\MyPhoneExplorer
2013-06-22 02:08 - 2012-06-15 02:03 - 00000000 ____D C:\Users\kevin\AppData\Local\BlueStacks
2013-06-22 02:08 - 2011-08-02 01:11 - 00000000 ____D C:\ProgramData\Origin
2013-06-22 02:08 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\AppCompat
2013-06-22 02:07 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration
2013-06-22 02:01 - 2010-10-28 06:55 - 00000000 ____D C:\Program Files\gPotato.eu
2013-06-22 00:24 - 2012-06-15 02:03 - 00000000 ____D C:\ProgramData\BlueStacks
2013-06-21 23:38 - 2013-06-21 23:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{A152DDA7-9317-45C6-8EF5-B86ED556741E}
2013-06-20 00:20 - 2013-06-20 00:20 - 00026760 ____A C:\Users\kevin\Downloads\bitshare_default.xml
2013-06-19 23:10 - 2013-06-19 23:10 - 00000000 ____D C:\Users\kevin\AppData\Local\{11E16F19-44CF-4006-B8C0-0E752F9E9D17}
2013-06-15 16:46 - 2013-06-15 16:45 - 00000000 ____D C:\Users\kevin\AppData\Local\{DCB07B9B-1C60-473E-A594-F2F334CCDEAC}
2013-06-15 16:43 - 2013-04-29 10:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins
2013-06-15 01:05 - 2013-06-15 01:05 - 00000000 ____D C:\Users\kevin\AppData\Local\{3CF6A213-4817-42E6-A4CB-3FD56676B4D4}
2013-06-15 00:59 - 2013-06-12 09:01 - 00001979 ____A C:\Users\Public\Desktop\Remote Control Server.lnk
2013-06-15 00:38 - 2012-12-14 00:35 - 00000000 ____D C:\Users\kevin\Desktop\beats
2013-06-15 00:38 - 2010-06-10 22:18 - 00000000 ___RD C:\Users\kevin\Desktop\Programme
2013-06-14 10:23 - 2013-06-14 10:23 - 00000000 ____D C:\Users\kevin\AppData\Local\{77A77206-43F3-416C-97A7-0146DF373D92}
2013-06-14 08:40 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-06-14 07:43 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\589457bd5c299aeeab
2013-06-14 03:12 - 2013-06-14 03:04 - 00000000 ____D C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 21:14 - 2013-06-14 15:59 - 00000000 ____D C:\Users\kevin\Desktop\BEST OF MAY 2013
2013-06-13 18:59 - 2012-05-25 21:51 - 00000000 ___RD C:\Program Files\Skype
2013-06-13 15:38 - 2013-06-13 03:37 - 00000000 ____D C:\Users\kevin\AppData\Local\{683C7EE4-369F-486F-9646-3D187EE7302F}
2013-06-13 03:37 - 2012-04-19 20:36 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-13 03:37 - 2011-12-08 01:13 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-13 03:23 - 2013-06-13 03:22 - 00086330 ____A C:\hcwDriverInstall.txt
2013-06-13 03:20 - 2013-06-13 03:20 - 00000000 ____D C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-13 03:20 - 2013-06-13 03:19 - 00173502 ____A C:\hcwclear.txt
2013-06-13 03:20 - 2013-02-08 14:40 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 03:19 - 2010-06-09 19:21 - 00000000 ____D C:\Windows\System32\Hauppauge
2013-06-13 01:23 - 2013-04-14 22:56 - 00001001 ____A C:\Users\Public\Desktop\ASUS GPU Tweak.lnk
2013-06-13 01:21 - 2011-01-06 04:31 - 00000000 ____D C:\Windows\Downloaded Installations
2013-06-12 09:01 - 2013-06-12 09:01 - 00000000 ____D C:\Program Files\Remote Control Server
2013-06-12 08:57 - 2012-07-02 22:15 - 00000000 ____D C:\Users\kevin\AppData\Local\Downloaded Installations
2013-06-12 08:54 - 2013-06-12 08:54 - 00000000 ____D C:\Users\kevin\Desktop\RNB4U.in - Best of May 2013
2013-06-12 02:02 - 2013-02-08 13:44 - 00113528 ____A C:\Users\Kevo\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-11 22:38 - 2013-06-11 22:38 - 00006890 ____A C:\OFB-EAST109546437.pkg
2013-06-11 22:21 - 2013-06-11 22:20 - 07944668 ____A C:\Users\kevin\Desktop\Baldgroßeronkel Mo Woodpacker.flv
2013-06-11 21:13 - 2013-06-11 21:13 - 00000975 ____A C:\Windows\System32\Drivers\etc\hosts.txt
2013-06-08 13:42 - 2013-06-14 03:13 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 13:40 - 2013-06-14 03:13 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 13:40 - 2013-06-14 03:13 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 13:40 - 2013-06-14 03:13 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 13:40 - 2013-06-14 03:13 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 13:13 - 2013-06-14 03:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 04:40 - 2011-08-02 01:14 - 00000000 ____D C:\Users\kevin\AppData\Roaming\Origin
2013-06-08 04:40 - 2011-08-02 01:14 - 00000000 ____D C:\Users\kevin\AppData\Local\Origin
2013-06-07 08:03 - 2012-10-19 06:02 - 00000000 ____D C:\Users\kevin\Desktop\aktuellere lieder
2013-06-06 20:34 - 2011-08-30 19:46 - 00000000 ____D C:\aktuelle lieder
2013-06-06 20:25 - 2013-06-06 20:24 - 00000000 ____D C:\Users\kevin\AppData\Local\{F7EFB78D-E40A-49F4-A17E-5302E8B17273}

Files to move or delete:
====================
C:\Users\kevin\AppData\Roaming\skype.dat
C:\Users\Kevo\AppData\Roaming\skype.dat
C:\Users\Kevo\AppData\Roaming\skype.ini

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-03 14:49

==================== End Of Log ============================
--- --- ---


Farbar service sncanner log:

Code:
Farbar Service Scanner Version: 06-07-2013
Ran by kevin (administrator) on 06-07-2013 at 09:10:02
Running from "C:\Users\kevin\Desktop"
Microsoft Windows 7 Home Premium  Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

Action Center Notification Icon =====> Unable to open HKLM\...\ShellServiceObjects\{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A} key. The key does not exist.


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is OK.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcore.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****
mfg kevin anthony :)

Aneri 07.07.2013 14:27
Hi, sry für die leichte Verzögerung ;)

Lesestoff:
Banking-Trojaner
Wenn du mit diesem Computer beispielsweise Onlinebanking machst, dann solltest du zumindest dein Passwort von deiner Bank ändern lassen, wenn du ein ansonsten sicheres Verfahren wie beispielsweise "chip-TAN-comfort" nutzt. Hast du noch alte TAN-Bögen auf Papierbasis? Dann ist es höchste Zeit dich bei deiner Bank zu melden und notfalls das Konto temporär sperren zu lassen. Der Sperrnotruf 116 116 von www.sperr-notruf.de kann Tag und Nacht dafür benutzt werden.


Schritt 1

Fix mit FRST
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
HKU\Kevo\...\Run: [Iwboavxoip] C:\Users\Kevo\AppData\Roaming\Kuosxu\ubent.exe [x]
HKU\Kevo\...\Run: [Nyciihi] C:\Users\Kevo\AppData\Roaming\Efuhuw\apum.exe [x]
HKU\Kevo\...\Winlogon: [Shell] explorer.exe <==== ATTENTION
FF HKLM\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] C:\Users\kevin\AppData\Roaming\5059
FF Extension: Java String Helper - C:\Users\kevin\AppData\Roaming\5059
FF HKCU\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] C:\Users\kevin\AppData\Roaming\5059
FF Extension: Java String Helper - C:\Users\kevin\AppData\Roaming\5059
S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x32.sys [x]
S3 UCORESYS; \??\C:\Users\Kevo\Desktop\UCORESYS.SYS [x]
HKCU\...\Run: [Remote Control Server] C:\Program Files\Remote Control Server\Remote Control Server.exe [2221056 2013-06-07] (Steppschuh)
C:\Program Files\Remote Control Server\Remote Control Server.exe
C:\Users\Kevo\Desktop\UCORESYS.SYS
C:\Windows\TEMP\cpuz136\cpuz136_x32.sys
C:\Users\kevin\AppData\Roaming\skype.dat
C:\Users\Kevo\AppData\Roaming\skype.dat
C:\Users\Kevo\AppData\Roaming\skype.ini
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Fix Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.

Schritt 2
Kontrollscan mit FRST
Führe wie zuvor beschrieben einen Scan mit FRST aus. Es wird nur eine FRST.txt erzeugt. Poste mir diese.

kevinanthony 07.07.2013 16:33
hey, kein problem ;)

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 04-07-2013
Ran by kevin at 2013-07-07 17:30:31 Run:3
Running from C:\Users\kevin\Desktop
Boot Mode: Normal

==============================================

HKU\Kevo\Software\Microsoft\Windows\CurrentVersion\Run\\Iwboavxoip => Value deleted successfully.
HKU\Kevo\Software\Microsoft\Windows\CurrentVersion\Run\\Nyciihi => Value deleted successfully.
HKU\Kevo\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
HKLM\Software\Mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4} => Value deleted successfully.
C:\Users\kevin\AppData\Roaming\5059 => Moved successfully.
HKCU\Software\Mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4} => Value deleted successfully.
C:\Users\kevin\AppData\Roaming\5059 => not found.
cpuz136 => Service deleted successfully.
UCORESYS => Service deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\Remote Control Server] C:\Program Files\Remote Control Server\Remote Control Server.exe [2221056 2013-06-07 => Value not found.
C:\Program Files\Remote Control Server\Remote Control Server.exe => Moved successfully.
"C:\Users\Kevo\Desktop\UCORESYS.SYS" => File/Directory not found.
"C:\Windows\TEMP\cpuz136\cpuz136_x32.sys" => File/Directory not found.
"C:\Users\kevin\AppData\Roaming\skype.dat" => File/Directory not found.
"C:\Users\Kevo\AppData\Roaming\skype.dat" => File/Directory not found.
C:\Users\Kevo\AppData\Roaming\skype.ini => Moved successfully.

==== End of Fixlog ====
kontrollscan


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 04-07-2013
Ran by kevin (administrator) on 07-07-2013 17:31:36
Running from C:\Users\kevin\Desktop
Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(MAGIX AG) C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(Tonec Inc.) C:\Program Files\Internet Download Manager\IDMan.exe
(Tonec Inc.) C:\Program Files\Internet Download Manager\IEMonitor.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
() C:\Windows\system32\PnkBstrA.exe
(Microsoft Corporation) C:\Windows\system32\taskmgr.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKCU\...\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot [3491264 2012-06-10] (Tonec Inc.)
HKCU\...\Run: [GPU Tweak Main] C:\Program Files\ASUS\GPU Tweak\GPUTweak.exe [3268608 2013-05-16] (ASUS)
HKCU\...\Run: [Remote Control Server] C:\Program Files\Remote Control Server\Remote Control Server.exe [x]
HKCU\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2012-07-15] (Google Inc.)
HKCU\...\Run: [ProxifyTrayApp] C:\Program Files\Proxify Tray Application\Proxify Tray Application.exe [2689536 2013-02-27] (UpsideOut, Inc.)
HKCU\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [19604072 2013-06-03] (Skype Technologies S.A.)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Kevo\...\Run: [Remote Control Server] C:\Program Files\Remote Control Server\Remote Control Server.exe [x]
HKU\Kevo\...\Run: [GPU Tweak Main] C:\Program Files\ASUS\GPU Tweak\GPUTweak.exe [ 2013-05-16] (ASUS)
HKU\Kevo\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [ 2013-06-03] (Skype Technologies S.A.)
HKU\Kevo\...\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot [ 2012-06-10] (Tonec Inc.)
HKU\Kevo\...\Policies\system: [LogonHoursAction] 2
HKU\Kevo\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
ShortcutTarget: Facebook Messenger.lnk -> C:\Users\kevin\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe (Facebook)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO: IDM integration (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/121022/CTPID.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog5 05 %SystemRoot%\system32\PrxerNsp.dll [61440] (Initex Software)
Winsock: Catalog5 06 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default
FF NetworkProxy: "backup.ftp", "securewebproxy.org"
FF NetworkProxy: "backup.ftp_port", 1111
FF NetworkProxy: "backup.gopher", "securewebproxy.org"
FF NetworkProxy: "backup.gopher_port", 1111
FF NetworkProxy: "backup.socks", "securewebproxy.org"
FF NetworkProxy: "backup.socks_port", 1111
FF NetworkProxy: "backup.ssl", "securewebproxy.org"
FF NetworkProxy: "backup.ssl_port", 1111
FF NetworkProxy: "ftp", "securewebproxy.org"
FF NetworkProxy: "ftp_port", 1111
FF NetworkProxy: "gopher", "securewebproxy.org"
FF NetworkProxy: "gopher_port", 1111
FF NetworkProxy: "http", "securewebproxy.org"
FF NetworkProxy: "http_port", 1111
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "securewebproxy.org"
FF NetworkProxy: "socks_port", 1111
FF NetworkProxy: "ssl", "securewebproxy.org"
FF NetworkProxy: "ssl_port", 1111
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @esn.me/esnsonar,version=0.70.4 - C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin: @esn/esnlaunch,version=2.1.7 - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin: @java.com/DTPlugin,version=1.6.0_33 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\kevin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\kevin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: facebook.com/fbDesktopPlugin - C:\Users\kevin\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Elite Proxy Switcher - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\eliteproxyswitcher@my-proxy.com
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{88cdf226-1a4e-467b-aa5d-1c2c70bbadc0}
FF Extension: DownloadHelper - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF HKCU\...\Firefox\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF HKCU\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5

========================== Services (Whitelisted) =================

S4 BstHdAndroidSvc; C:\Program Files\BlueStacks\HD-Service.exe [397704 2012-05-31] (BlueStack Systems, Inc.)
S4 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [385416 2012-05-31] (BlueStack Systems, Inc.)
S4 Connectify; C:\Program Files\Connectify\ConnectifyService.exe [65536 2012-05-02] ()
S4 CPUCooLServer; C:\Program Files\CPUCooL\CooLSrv.exe [743936 2011-12-01] ()
S4 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2010-09-17] (Creative Labs)
S4 Creative Media Toolbox 6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\MT6Licensing.exe [79360 2010-08-02] (Creative Labs)
S4 EMP_UDSA; C:\Program Files\EPSON Projector\Epson USB Display V1.5\EMP_UDSA.exe [98304 2011-01-06] (SEIKO EPSON CORPORATION)
R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG)
S4 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®)
S4 Futuremark SystemInfo Service; C:\Program Files\Futuremark\Futuremark SystemInfo\FMSISvc.exe [137488 2012-12-17] (Futuremark Corporation)
S4 GtDetectSc; C:\Program Files\Option\Option WWAN Driver 5.0.32.0 Installer\GtDetectSc.exe [545792 2009-05-04] (OptionNV)
S4 HauppaugeTVServer; C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe [558592 2010-11-03] (Hauppauge Computer Works)
S4 HerculesDJControlMP3; C:\Program Files\Hercules\Audio\DJ Console Series\drivers\x86\HerculesDJControlMP3.EXE [17408 2010-12-23] ()
S4 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [655944 2012-07-03] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation)
S4 npggsvc; C:\Windows\system32\GameMon.des [3890920 2010-06-17] (INCA Internet Co., Ltd.)
S4 NWHelper; C:\Program Files\Novatel Wireless\Drivers\NWHelper.exe [193824 2009-12-04] (Novatel Wireless Inc.)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2013-07-07] ()
S4 Realtek11nCU; C:\Program Files\SITECOM\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-17] (Realtek)
S4 Sony Ericsson PCCompanion; C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [150528 2011-02-10] (Avanquest Software)
S4 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [201344 2012-01-10] (Telefónica)
S4 UI Assistant Service; C:\Program Files\Mobile Partner Manager\AssistantServices.exe [241664 2009-03-24] ()
S4 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
S4 VMCService; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [9216 2009-04-20] (Vodafone)
S2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [x]
S4 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x]
S2 vToolbarUpdater15.1.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.1.0\ToolbarUpdater.exe [x]

==================== Drivers (Whitelisted) ====================

R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [34592 2013-05-03] (AVG Technologies)
R2 BstHdDrv; C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [66952 2012-05-31] (BlueStack Systems)
R3 Bulk; C:\Windows\System32\Drivers\HDJBulk.sys [153600 2010-12-23] (© Guillemot R&D, 2010. All rights reserved.)
S1 cnnctfy2; C:\Windows\System32\DRIVERS\cnnctfy2.sys [27248 2012-07-03] (Connectify)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [219352 2009-06-05] (Intel Corporation)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [867344 2012-11-14] (<Turtle Entertainment>)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R3 hcw17bda; C:\Windows\System32\drivers\hcw17bda.sys [54016 2010-01-27] (Hauppauge Computer Works, Inc.)
R3 HDJMidi; C:\Windows\System32\DRIVERS\HDJMidi.sys [192000 2010-12-23] (© Guillemot R&D, 2010. All rights reserved.)
R3 ksaud; C:\Windows\System32\drivers\ksaud.sys [899712 2011-07-06] (Creative Technology Ltd.)
S3 LVPr2Mon; C:\Windows\System32\Drivers\LVPr2Mon.sys [25824 2010-05-07] ()
R1 MagicTune; C:\Windows\system32\drivers\MTiCtwl.sys [14336 2010-04-22] (Samsung Electronics, Inc. )
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [9728 2009-02-03] (ZTE Incorporated)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22344 2012-07-03] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
R1 MpKsl2d364ba5; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A2EA1476-D2CB-4C23-A58B-7DE1894F977F}\MpKsl2d364ba5.sys [29904 2013-07-07] (Microsoft Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
R1 ntiopnp; C:\Windows\System32\Drivers\ntiopnp.sys [21080 2010-11-11] ()
R1 ntiowp; C:\Windows\System32\Drivers\ntiowp.sys [12352 2006-10-20] ()
S3 NVFLASH; C:\Windows\system32\drivers\nvflash.sys [12864 2012-03-10] ()
S3 NVR0Dev; C:\Windows\nvoclock.sys [6912 2006-10-31] (NVidia Corp.)
S3 pneteth; C:\Windows\System32\DRIVERS\pneteth.sys [13312 2011-07-19] (June Fabrics Technology Inc.)
S3 PRODIGY; C:\Windows\System32\Drivers\PRODIGY.SYS [32377 2006-08-29] (B-phreaks)
R2 PStrip; C:\Windows\system32\DRIVERS\PSTRIP.SYS [27992 2007-07-15] (EnTech Taiwan)
S3 RivaTuner32; C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys [9088 2009-08-22] ()
R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-29] (Almico Software)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 catchme; \??\C:\Users\kevin\AppData\Local\Temp\catchme.sys [x]
S3 clwvd; system32\DRIVERS\clwvd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-07 17:28 - 2013-07-07 17:28 - 00001159 ____A C:\Users\kevin\Desktop\Uplay.lnk
2013-07-07 15:16 - 2013-07-07 15:16 - 00000000 ____A C:\Users\kevin\Desktop\mr hang.txt
2013-07-06 11:13 - 2010-07-07 23:09 - 03948600 ____A (Microsoft Corporation) C:\Windows\System32\ntkrlICE.exe
2013-07-06 11:12 - 2012-10-21 11:19 - 03852800 ____A (ICE Technologie) C:\Users\kevin\Desktop\4GB-RAMPatch-Multilingual-12.7.2010.exe
2013-07-06 11:11 - 2013-07-06 11:11 - 02453570 ____A C:\Users\kevin\Desktop\4GB-RAMPatch-Multilingual-12.7.2010.rar
2013-07-06 09:10 - 2013-07-06 09:10 - 00002592 ____A C:\Users\kevin\Desktop\FSS.txt
2013-07-06 09:09 - 2013-07-06 09:09 - 00356399 ____A (Farbar) C:\Users\kevin\Desktop\FSS.exe
2013-07-06 05:16 - 2013-07-06 05:16 - 00014227 ____A C:\Users\kevin\Desktop\hs_err_pid8064.log
2013-07-05 13:40 - 2013-07-05 13:40 - 00035493 ____A C:\ComboFix.txt
2013-07-05 13:06 - 2013-07-05 13:40 - 00000000 ____D C:\Qoobox
2013-07-05 13:06 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-07-05 13:06 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-07-05 13:06 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-07-05 13:05 - 2013-07-05 13:37 - 00000000 ____D C:\Windows\erdnt
2013-07-05 13:04 - 2013-07-05 13:04 - 05085494 ____R (Swearware) C:\Users\kevin\Desktop\ComboFix.exe
2013-07-04 21:45 - 2013-07-04 21:45 - 00282521 ____A C:\Users\kevin\Desktop\gvu.dib
2013-07-04 21:33 - 2013-07-04 21:34 - 00039819 ____A C:\AdwCleaner[S1].txt
2013-07-04 20:46 - 2013-07-04 20:46 - 00000000 ____D C:\Users\kevin\AppData\Local\Avg2013
2013-07-04 18:01 - 2013-07-04 18:01 - 00000000 ____D C:\FRST
2013-07-04 17:59 - 2013-07-04 18:00 - 01373373 ____A (Farbar) C:\Users\kevin\Desktop\FRST.exe
2013-07-04 17:15 - 2013-07-04 17:16 - 00040080 ____A C:\AdwCleaner[R1].txt
2013-07-04 17:13 - 2013-07-04 17:13 - 00650027 ____A C:\Users\kevin\Desktop\adwcleaner.exe
2013-07-04 15:29 - 2013-07-04 15:29 - 00000000 ____A C:\Users\kevin\Downloads\Fall Out Boy Ft[1]. Lil Wayne, Lupe Fiasco, Kanye West, Travis (of Gym Class Heroes), Tyga, Paul Wall, & Skin Head Rob) - This Aint A Scene, It An Arms Race (Rem
2013-07-04 13:02 - 2013-07-04 13:02 - 21703480 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 22.0.exe
2013-07-03 13:36 - 2013-07-03 13:36 - 00014212 ____A C:\Users\kevin\Desktop\hs_err_pid3876.log
2013-06-30 09:26 - 2013-06-30 09:26 - 00000000 ____D C:\Users\kevin\AppData\Local\{B2B348CF-713B-454E-AF1F-88D90571896E}
2013-06-30 09:21 - 2013-01-18 16:21 - 04133664 ____A (NVIDIA Corporation) C:\Windows\System32\nvcpl.dll
2013-06-30 09:21 - 2013-01-18 16:21 - 03005728 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvc.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 02953448 ____A C:\Windows\System32\nvcoproc.bin
2013-06-30 09:21 - 2013-01-18 16:20 - 02557728 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvcr.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 00639776 ____A (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
2013-06-30 09:21 - 2013-01-18 16:20 - 00108832 ____A (NVIDIA Corporation) C:\Windows\System32\nvmctray.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 00062752 ____A (NVIDIA Corporation) C:\Windows\System32\nvshext.dll
2013-06-30 09:20 - 2013-06-30 09:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-06-30 08:57 - 2013-06-30 08:59 - 171934904 ____A (NVIDIA Corporation) C:\Users\kevin\Desktop\314.22-desktop-win8-win7-winvista-32bit-international-whql.exe
2013-06-27 03:11 - 2013-06-27 03:11 - 00000000 ____D C:\Program Files\Proxify Tray Application
2013-06-24 23:54 - 2013-06-24 23:54 - 00001188 ____A C:\Users\kevin\Desktop\iSRO - Verknüpfung.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00001105 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\ProgramData\Mozilla
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-23 08:42 - 2013-06-23 08:42 - 21151576 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 21.0.exe
2013-06-23 08:19 - 2013-06-24 23:54 - 00000000 ____D C:\Program Files\iSRO
2013-06-23 08:01 - 2013-06-23 08:16 - 1783991173 ____A C:\Users\kevin\Downloads\iSRO_286(2).exe
2013-06-22 23:31 - 2013-06-22 23:31 - 00000000 ____D C:\Users\kevin\AppData\Local\{C0DD6DF3-7E5F-495F-BC91-ED1CF71F38A8}
2013-06-22 03:07 - 2013-06-22 03:07 - 00000000 ____D C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-21 23:38 - 2013-06-21 23:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{A152DDA7-9317-45C6-8EF5-B86ED556741E}
2013-06-20 00:20 - 2013-06-20 00:20 - 00026760 ____A C:\Users\kevin\Downloads\bitshare_default.xml
2013-06-19 23:10 - 2013-06-19 23:10 - 00000000 ____D C:\Users\kevin\AppData\Local\{11E16F19-44CF-4006-B8C0-0E752F9E9D17}
2013-06-15 16:45 - 2013-06-15 16:46 - 00000000 ____D C:\Users\kevin\AppData\Local\{DCB07B9B-1C60-473E-A594-F2F334CCDEAC}
2013-06-15 01:05 - 2013-06-15 01:05 - 00000000 ____D C:\Users\kevin\AppData\Local\{3CF6A213-4817-42E6-A4CB-3FD56676B4D4}
2013-06-14 15:59 - 2013-06-13 21:14 - 00000000 ____D C:\Users\kevin\Desktop\BEST OF MAY 2013
2013-06-14 10:23 - 2013-06-14 10:23 - 00000000 ____D C:\Users\kevin\AppData\Local\{77A77206-43F3-416C-97A7-0146DF373D92}
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\589457bd5c299aeeab
2013-06-14 03:13 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-14 03:13 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-14 03:04 - 2013-06-14 03:12 - 00000000 ____D C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 03:37 - 2013-06-13 15:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{683C7EE4-369F-486F-9646-3D187EE7302F}
2013-06-13 03:22 - 2013-06-13 03:23 - 00086330 ____A C:\hcwDriverInstall.txt
2013-06-13 03:22 - 2010-01-18 14:01 - 00098384 ____A C:\Windows\System32\Drivers\hcw17isd.1b0
2013-06-13 03:22 - 2009-12-09 13:43 - 00101056 ____A C:\Windows\System32\Drivers\hcw17dvb.1b0
2013-06-13 03:22 - 2009-08-11 14:35 - 00249856 ____A (Siano Mobile Silicon) C:\Windows\System32\HcwSmsCt.dll
2013-06-13 03:20 - 2013-06-13 03:20 - 00000000 ____D C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-13 03:19 - 2013-06-13 03:20 - 00173502 ____A C:\hcwclear.txt
2013-06-13 03:19 - 2013-05-17 03:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 03:19 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 03:19 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 09:01 - 2013-07-07 17:30 - 00000000 ____D C:\Program Files\Remote Control Server
2013-06-12 09:01 - 2013-06-15 00:59 - 00001979 ____A C:\Users\Public\Desktop\Remote Control Server.lnk
2013-06-12 08:54 - 2013-06-12 08:54 - 00000000 ____D C:\Users\kevin\Desktop\RNB4U.in - Best of May 2013
2013-06-12 02:24 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 02:24 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 02:24 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 02:23 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 02:23 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 02:23 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 02:23 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 02:23 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 02:23 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-11 22:38 - 2013-06-11 22:38 - 00006890 ____A C:\OFB-EAST109546437.pkg
2013-06-11 22:20 - 2013-06-11 22:21 - 07944668 ____A C:\Users\kevin\Desktop\Baldgroßeronkel Mo Woodpacker.flv
2013-06-11 21:13 - 2013-06-11 21:13 - 00000975 ____A C:\Windows\System32\Drivers\etc\hosts.txt
2013-06-08 04:28 - 2013-06-30 08:41 - 00000000 ____D C:\Users\kevin\AppData\Local\NVIDIA
2013-06-08 04:20 - 2013-02-25 07:27 - 00154400 ____A (NVIDIA Corporation) C:\Windows\System32\Drivers\nvhda32v.sys
2013-06-08 04:20 - 2013-02-25 07:27 - 00028448 ____A (NVIDIA Corporation) C:\Windows\System32\nvhdap32.dll

==================== One Month Modified Files and Folders ========

2013-07-07 17:30 - 2013-06-12 09:01 - 00000000 ____D C:\Program Files\Remote Control Server
2013-07-07 17:28 - 2013-07-07 17:28 - 00001159 ____A C:\Users\kevin\Desktop\Uplay.lnk
2013-07-07 17:11 - 2010-12-27 20:52 - 00282512 ____A C:\Windows\System32\PnkBstrB.exe
2013-07-07 17:11 - 2010-12-27 20:51 - 00076888 ____A C:\Windows\System32\PnkBstrA.exe
2013-07-07 17:08 - 2009-07-14 06:34 - 00015152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-07 17:08 - 2009-07-14 06:34 - 00015152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-07 17:07 - 2012-07-15 20:32 - 00001096 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-07 17:02 - 2010-12-02 21:26 - 00000000 ____D C:\Users\kevin\AppData\Roaming\Skype
2013-07-07 17:00 - 2013-04-05 23:30 - 07759912 ____A C:\Windows\setupact.log
2013-07-07 17:00 - 2013-02-08 06:51 - 00000000 ____D C:\users\kevin
2013-07-07 17:00 - 2012-07-15 20:32 - 00001092 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-07 16:59 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-07 16:59 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\wfp
2013-07-07 16:55 - 2013-02-08 06:51 - 00000000 ____D C:\users\Kevo
2013-07-07 16:55 - 2012-07-05 21:43 - 00000000 ____D C:\Users\Kevo\AppData\Roaming\Skype
2013-07-07 16:55 - 2012-01-31 16:58 - 00000000 ____D C:\Users\kevin\Documents\Assassin's Creed Revelations
2013-07-07 16:55 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration
2013-07-07 16:54 - 2011-07-25 22:35 - 00000000 ____D C:\Program Files\Ubisoft
2013-07-07 16:45 - 2010-06-09 20:58 - 00000000 ____D C:\Users\kevin\AppData\Roaming\DMCache
2013-07-07 16:06 - 2012-12-13 22:03 - 00000000 ____D C:\Users\Kevo\AppData\Roaming\DMCache
2013-07-07 15:16 - 2013-07-07 15:16 - 00000000 ____A C:\Users\kevin\Desktop\mr hang.txt
2013-07-07 06:37 - 2012-04-19 20:36 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-07 06:00 - 2011-09-13 20:56 - 00000928 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001UA.job
2013-07-07 05:06 - 2013-02-08 08:48 - 01216487 ____A C:\Windows\WindowsUpdate.log
2013-07-07 01:01 - 2011-09-13 20:56 - 00000906 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001Core.job
2013-07-06 13:50 - 2012-02-01 22:54 - 00291088 ____A C:\Windows\System32\PnkBstrB.xtr
2013-07-06 13:50 - 2010-12-27 20:52 - 00280904 ____A C:\Windows\System32\PnkBstrB.ex0
2013-07-06 13:50 - 2010-12-27 20:52 - 00137992 ____A C:\Windows\System32\Drivers\PnkBstrK.sys
2013-07-06 11:35 - 2011-08-02 01:11 - 00000000 ____D C:\Program Files\Origin
2013-07-06 11:28 - 2013-04-26 18:27 - 00008546 ____A C:\Windows\PFRO.log
2013-07-06 11:25 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-07-06 11:25 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-07-06 11:11 - 2013-07-06 11:11 - 02453570 ____A C:\Users\kevin\Desktop\4GB-RAMPatch-Multilingual-12.7.2010.rar
2013-07-06 09:10 - 2013-07-06 09:10 - 00002592 ____A C:\Users\kevin\Desktop\FSS.txt
2013-07-06 09:09 - 2013-07-06 09:09 - 00356399 ____A (Farbar) C:\Users\kevin\Desktop\FSS.exe
2013-07-06 05:45 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-06 05:16 - 2013-07-06 05:16 - 00014227 ____A C:\Users\kevin\Desktop\hs_err_pid8064.log
2013-07-05 21:44 - 2013-02-08 06:49 - 01607382 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-05 19:23 - 2009-07-14 10:56 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-07-05 13:40 - 2013-07-05 13:40 - 00035493 ____A C:\ComboFix.txt
2013-07-05 13:40 - 2013-07-05 13:06 - 00000000 ____D C:\Qoobox
2013-07-05 13:40 - 2009-07-14 04:37 - 00000000 __RHD C:\users\Default
2013-07-05 13:40 - 2009-07-14 04:37 - 00000000 ___RD C:\users\Public
2013-07-05 13:37 - 2013-07-05 13:05 - 00000000 ____D C:\Windows\erdnt
2013-07-05 13:30 - 2009-07-14 04:04 - 00000215 ____A C:\Windows\system.ini
2013-07-05 13:04 - 2013-07-05 13:04 - 05085494 ____R (Swearware) C:\Users\kevin\Desktop\ComboFix.exe
2013-07-05 13:03 - 2012-07-05 14:33 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-07-05 13:03 - 2012-07-05 14:33 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy
2013-07-04 21:45 - 2013-07-04 21:45 - 00282521 ____A C:\Users\kevin\Desktop\gvu.dib
2013-07-04 21:34 - 2013-07-04 21:33 - 00039819 ____A C:\AdwCleaner[S1].txt
2013-07-04 21:27 - 2013-05-03 02:01 - 00000000 ____D C:\ProgramData\MFAData
2013-07-04 20:46 - 2013-07-04 20:46 - 00000000 ____D C:\Users\kevin\AppData\Local\Avg2013
2013-07-04 18:01 - 2013-07-04 18:01 - 00000000 ____D C:\FRST
2013-07-04 18:00 - 2013-07-04 17:59 - 01373373 ____A (Farbar) C:\Users\kevin\Desktop\FRST.exe
2013-07-04 17:16 - 2013-07-04 17:15 - 00040080 ____A C:\AdwCleaner[R1].txt
2013-07-04 17:13 - 2013-07-04 17:13 - 00650027 ____A C:\Users\kevin\Desktop\adwcleaner.exe
2013-07-04 15:29 - 2013-07-04 15:29 - 00000000 ____A C:\Users\kevin\Downloads\Fall Out Boy Ft[1]. Lil Wayne, Lupe Fiasco, Kanye West, Travis (of Gym Class Heroes), Tyga, Paul Wall, & Skin Head Rob) - This Aint A Scene, It An Arms Race (Rem
2013-07-04 13:03 - 2010-06-14 22:25 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-07-04 13:02 - 2013-07-04 13:02 - 21703480 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 22.0.exe
2013-07-03 13:36 - 2013-07-03 13:36 - 00014212 ____A C:\Users\kevin\Desktop\hs_err_pid3876.log
2013-07-02 19:56 - 2010-09-18 15:19 - 00000000 ____D C:\Users\kevin\Documents\VirtualDJ
2013-07-02 18:56 - 2010-06-10 22:15 - 00000000 ____D C:\Users\kevin\Desktop\bilder
2013-07-02 18:51 - 2013-02-08 13:41 - 00000680 _RASH C:\Users\Kevo\ntuser.pol
2013-06-30 15:08 - 2010-12-02 21:26 - 00000000 ____D C:\ProgramData\Skype
2013-06-30 14:53 - 2010-06-09 18:37 - 00000000 ____D C:\Program Files\Windows Live
2013-06-30 14:51 - 2009-07-14 04:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-06-30 09:26 - 2013-06-30 09:26 - 00000000 ____D C:\Users\kevin\AppData\Local\{B2B348CF-713B-454E-AF1F-88D90571896E}
2013-06-30 09:24 - 2010-06-09 19:07 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-30 09:21 - 2010-06-09 18:34 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-06-30 09:20 - 2013-06-30 09:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-06-30 09:17 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\DriverStore
2013-06-30 08:59 - 2013-06-30 08:57 - 171934904 ____A (NVIDIA Corporation) C:\Users\kevin\Desktop\314.22-desktop-win8-win7-winvista-32bit-international-whql.exe
2013-06-30 08:41 - 2013-06-08 04:28 - 00000000 ____D C:\Users\kevin\AppData\Local\NVIDIA
2013-06-29 15:44 - 2011-03-01 19:17 - 00000000 ____D C:\Program Files\Steam
2013-06-27 03:11 - 2013-06-27 03:11 - 00000000 ____D C:\Program Files\Proxify Tray Application
2013-06-26 14:12 - 2012-08-03 12:02 - 00000000 ____D C:\Users\kevin\Downloads\Video
2013-06-25 00:57 - 2013-04-03 20:25 - 00000000 ____D C:\Program Files\Futuremark
2013-06-25 00:57 - 2010-06-09 19:21 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-06-24 23:54 - 2013-06-24 23:54 - 00001188 ____A C:\Users\kevin\Desktop\iSRO - Verknüpfung.lnk
2013-06-24 23:54 - 2013-06-23 08:19 - 00000000 ____D C:\Program Files\iSRO
2013-06-23 08:43 - 2013-06-23 08:43 - 00001105 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\ProgramData\Mozilla
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-23 08:42 - 2013-06-23 08:42 - 21151576 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 21.0.exe
2013-06-23 08:16 - 2013-06-23 08:01 - 1783991173 ____A C:\Users\kevin\Downloads\iSRO_286(2).exe
2013-06-22 23:31 - 2013-06-22 23:31 - 00000000 ____D C:\Users\kevin\AppData\Local\{C0DD6DF3-7E5F-495F-BC91-ED1CF71F38A8}
2013-06-22 08:33 - 2013-02-08 20:20 - 00000680 _RASH C:\Users\kevin\ntuser.pol
2013-06-22 03:07 - 2013-06-22 03:07 - 00000000 ____D C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-22 02:11 - 2012-06-15 02:03 - 00000000 ____D C:\Program Files\BlueStacks
2013-06-22 02:08 - 2012-07-15 22:09 - 00000000 ____D C:\Users\kevin\AppData\Roaming\MyPhoneExplorer
2013-06-22 02:08 - 2012-06-15 02:03 - 00000000 ____D C:\Users\kevin\AppData\Local\BlueStacks
2013-06-22 02:08 - 2011-08-02 01:11 - 00000000 ____D C:\ProgramData\Origin
2013-06-22 02:08 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\AppCompat
2013-06-22 02:01 - 2010-10-28 06:55 - 00000000 ____D C:\Program Files\gPotato.eu
2013-06-22 00:24 - 2012-06-15 02:03 - 00000000 ____D C:\ProgramData\BlueStacks
2013-06-21 23:38 - 2013-06-21 23:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{A152DDA7-9317-45C6-8EF5-B86ED556741E}
2013-06-20 00:20 - 2013-06-20 00:20 - 00026760 ____A C:\Users\kevin\Downloads\bitshare_default.xml
2013-06-19 23:10 - 2013-06-19 23:10 - 00000000 ____D C:\Users\kevin\AppData\Local\{11E16F19-44CF-4006-B8C0-0E752F9E9D17}
2013-06-15 16:46 - 2013-06-15 16:45 - 00000000 ____D C:\Users\kevin\AppData\Local\{DCB07B9B-1C60-473E-A594-F2F334CCDEAC}
2013-06-15 16:43 - 2013-04-29 10:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins
2013-06-15 01:05 - 2013-06-15 01:05 - 00000000 ____D C:\Users\kevin\AppData\Local\{3CF6A213-4817-42E6-A4CB-3FD56676B4D4}
2013-06-15 00:59 - 2013-06-12 09:01 - 00001979 ____A C:\Users\Public\Desktop\Remote Control Server.lnk
2013-06-15 00:38 - 2012-12-14 00:35 - 00000000 ____D C:\Users\kevin\Desktop\beats
2013-06-15 00:38 - 2010-06-10 22:18 - 00000000 ___RD C:\Users\kevin\Desktop\Programme
2013-06-14 10:23 - 2013-06-14 10:23 - 00000000 ____D C:\Users\kevin\AppData\Local\{77A77206-43F3-416C-97A7-0146DF373D92}
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\589457bd5c299aeeab
2013-06-14 03:12 - 2013-06-14 03:04 - 00000000 ____D C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 21:14 - 2013-06-14 15:59 - 00000000 ____D C:\Users\kevin\Desktop\BEST OF MAY 2013
2013-06-13 18:59 - 2012-05-25 21:51 - 00000000 ___RD C:\Program Files\Skype
2013-06-13 15:38 - 2013-06-13 03:37 - 00000000 ____D C:\Users\kevin\AppData\Local\{683C7EE4-369F-486F-9646-3D187EE7302F}
2013-06-13 03:37 - 2012-04-19 20:36 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-13 03:37 - 2011-12-08 01:13 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-13 03:23 - 2013-06-13 03:22 - 00086330 ____A C:\hcwDriverInstall.txt
2013-06-13 03:20 - 2013-06-13 03:20 - 00000000 ____D C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-13 03:20 - 2013-06-13 03:19 - 00173502 ____A C:\hcwclear.txt
2013-06-13 03:20 - 2013-02-08 14:40 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 03:19 - 2010-06-09 19:21 - 00000000 ____D C:\Windows\System32\Hauppauge
2013-06-13 01:23 - 2013-04-14 22:56 - 00001001 ____A C:\Users\Public\Desktop\ASUS GPU Tweak.lnk
2013-06-13 01:21 - 2011-01-06 04:31 - 00000000 ____D C:\Windows\Downloaded Installations
2013-06-12 08:57 - 2012-07-02 22:15 - 00000000 ____D C:\Users\kevin\AppData\Local\Downloaded Installations
2013-06-12 08:54 - 2013-06-12 08:54 - 00000000 ____D C:\Users\kevin\Desktop\RNB4U.in - Best of May 2013
2013-06-12 02:02 - 2013-02-08 13:44 - 00113528 ____A C:\Users\Kevo\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-11 22:38 - 2013-06-11 22:38 - 00006890 ____A C:\OFB-EAST109546437.pkg
2013-06-11 22:21 - 2013-06-11 22:20 - 07944668 ____A C:\Users\kevin\Desktop\Baldgroßeronkel Mo Woodpacker.flv
2013-06-11 21:13 - 2013-06-11 21:13 - 00000975 ____A C:\Windows\System32\Drivers\etc\hosts.txt
2013-06-08 13:42 - 2013-06-14 03:13 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 13:40 - 2013-06-14 03:13 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 13:40 - 2013-06-14 03:13 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 13:40 - 2013-06-14 03:13 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 13:40 - 2013-06-14 03:13 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 13:13 - 2013-06-14 03:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 04:40 - 2011-08-02 01:14 - 00000000 ____D C:\Users\kevin\AppData\Roaming\Origin
2013-06-08 04:40 - 2011-08-02 01:14 - 00000000 ____D C:\Users\kevin\AppData\Local\Origin
2013-06-07 08:03 - 2012-10-19 06:02 - 00000000 ____D C:\Users\kevin\Desktop\aktuellere lieder

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!


LastRegBack: 2013-07-03 14:49

==================== End Of Log ============================
--- --- ---


mfg kevin anthony

Aneri 07.07.2013 20:37
Hi

bitte mach mal folgendes

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers


Alle Zeitangaben in WEZ +1. Es ist jetzt 20:46 Uhr.
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131